CVE-2018-19211
Fixed in a distro release EPSS <1%
In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.
Products: invisible-island ncurses
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ncurses | 6.1+20180210-3 |
| Debian 13 | ncurses | 6.1+20180210-3 |
| Debian 14 | ncurses | 6.1+20180210-3 |
| SUSE Linux Enterprise Desktop 12 SP3 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | ncurses | 6.1-5.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 | ncurses | 6.1-5.3.1 |
| SUSE Linux Enterprise Module for Legacy 15 | ncurses | 6.1-5.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Server 12 SP4 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | ncurses | 5.9-61.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ncurses | 5.9-61.1 |
| Ubuntu 18.04 LTS | ncurses | 6.1-1ubuntu1.18.04 |
| Ubuntu Pro 14.04 LTS | ncurses | 5.9+20140118-1ubuntu1+esm2 |
| Ubuntu Pro 16.04 LTS | ncurses | 6.0+20160213-1ubuntu1+esm2 |