CVE-2017-13732
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
An illegal memory access was found in ncurses 6.0 in the dump_uses() function in progs/dump_entry.c, potentially leading to a remote denial of service attack.
Risk Assessment
An attacker can remotely crash applications using ncurses, causing service disruption.
Recommendation
Update ncurses to the latest version that includes fixes for these memory bugs.
Other vulnerabilities in ncurses
See all- CVE-2017-10685Critical
In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2017-10684Critical
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2020-19190Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:70. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19189Medium
In ncurses 6.1, a buffer overflow vulnerability in the postprocess_terminfo function in tinfo/parse_entry.c:997 allows a remote attacker to cause a denial of service via a crafted command.
- CVE-2020-19188Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1116. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19187Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1100. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19186Medium
A buffer overflow vulnerability was detected in ncurses version 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:66. A remote attacker can cause a denial of service via a crafted command.
- CVE-2020-19185Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the one_one_mapping function in progs/dump_entry.c:1373. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2023-29491High
A vulnerability in ncurses before version 6.4 20230408 allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file located in $HOME/.terminfo or accessed via the TERMINFO or TERM environment variable, when used by a setuid application.
- CVE-2022-29458High
In the ncurses library version 6.3 before patch 20220416, an out-of-bounds read and segmentation violation exist in the convert_strings function in tinfo/read_entry.c of the terminfo library.
Original NVD description (English source)
There is an illegal address access in the function dump_uses() in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS