CVE-2002-0062
HighExploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A buffer overflow in ncurses 5.0 and the ncurses4 compatibility package in Red Hat Linux, related to cursor movement and scrolling routines, allows local users to gain privileges.
Risk Assessment
A local user can gain elevated privileges, enabling privilege escalation and full system compromise.
Recommendation
Update ncurses to the latest available version (e.g., 5.2 or later) and apply security patches from the distributor.
Other vulnerabilities in ncurses
See all- CVE-2017-10685Critical
In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2017-10684Critical
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2020-19190Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:70. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19189Medium
In ncurses 6.1, a buffer overflow vulnerability in the postprocess_terminfo function in tinfo/parse_entry.c:997 allows a remote attacker to cause a denial of service via a crafted command.
- CVE-2020-19188Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1116. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19187Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1100. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19186Medium
A buffer overflow vulnerability was detected in ncurses version 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:66. A remote attacker can cause a denial of service via a crafted command.
- CVE-2020-19185Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the one_one_mapping function in progs/dump_entry.c:1373. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2023-29491High
A vulnerability in ncurses before version 6.4 20230408 allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file located in $HOME/.terminfo or accessed via the TERMINFO or TERM environment variable, when used by a setuid application.
- CVE-2022-29458High
In the ncurses library version 6.3 before patch 20220416, an out-of-bounds read and segmentation violation exist in the convert_strings function in tinfo/read_entry.c of the terminfo library.
Original NVD description (English source)
Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolling."