CVE-2018-19211
MediumCVSS 5.5Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
In ncurses 6.1, a null pointer dereference in the _nc_parse_entry function in parse_entry.c leads to a denial of service attack. The program proceeds to the dereference code path even after detecting a "dubious character `*' in name or alias field".
Risk Assessment
An attacker can crash the ncurses program, potentially leading to denial of service in applications that use this library.
Recommendation
Update ncurses to a version newer than 6.1 that contains the fix.
Original NVD description (English source)
In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.