PT-2023-5180 · Ncurses+9 · Ncurses+9
Jbo
+1
·
Publicado
2023-04-12
·
Atualizado
2025-11-04
·
CVE-2023-29491
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ncurses versions prior to 6.4 20230408
Description
The issue is related to security-relevant memory corruption via malformed data in a terminfo database file. This can be triggered by local users when the software is used by a setuid application. The corruption can occur when the software accesses files found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variables. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.
Recommendations
For ncurses versions prior to 6.4 20230408, update to version 6.4 20230408 or later to resolve the issue. As a temporary workaround, consider restricting access to the terminfo database files and environment variables TERMINFO and TERM to minimize the risk of exploitation. Avoid using malformed data in the terminfo database files until the issue is resolved.
Exploit
Correção
DoS
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Astra Linux
Centos
Linuxmint
Apple Macos
Red Hat
Red Os
Suse
Ubuntu
Ncurses