CVE-2017-16879
Fixed in a distro release EPSS 2%
Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.
Products: invisible-island ncurses
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.11 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.12 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.13 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.14 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.15 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.16 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.17 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.18 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.19 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.20 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.21 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.22 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.23 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.24 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.4 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.5 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.6 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.7 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.8 | ncurses | 6.0_p20171125-r0 |
| Alpine 3.9 | ncurses | 6.0_p20171125-r0 |
| Debian 12 | ncurses | 6.0+20171125-1 |
| Debian 13 | ncurses | 6.0+20171125-1 |
| Debian 14 | ncurses | 6.0+20171125-1 |
| SUSE Linux Enterprise Server 11 SP4 | ncurses | 5.6-93.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ncurses | 5.6-93.12.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | ncurses | 5.6-93.12.1 |
| Ubuntu Pro 14.04 LTS | ncurses | 5.9+20140118-1ubuntu1+esm2 |
| Ubuntu Pro 16.04 LTS | ncurses | 6.0+20160213-1ubuntu1+esm2 |