CVE-2020-19185
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
A buffer overflow vulnerability was found in ncurses 6.1 in the one_one_mapping function in progs/dump_entry.c:1373. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
Risk Assessment
The organization is at risk of DoS attacks that can disrupt applications using ncurses, such as terminals and text-based tools, potentially affecting productivity.
Recommendation
Update the ncurses library to the latest available version that includes a security fix. Check for updates in your system distribution's repository.
Other vulnerabilities in ncurses
See all- CVE-2017-10685Critical
In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2017-10684Critical
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.
- CVE-2020-19190Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:70. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19189Medium
In ncurses 6.1, a buffer overflow vulnerability in the postprocess_terminfo function in tinfo/parse_entry.c:997 allows a remote attacker to cause a denial of service via a crafted command.
- CVE-2020-19188Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1116. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19187Medium
A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1100. A remote attacker can cause a denial of service (DoS) by sending a crafted command.
- CVE-2020-19186Medium
A buffer overflow vulnerability was detected in ncurses version 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:66. A remote attacker can cause a denial of service via a crafted command.
- CVE-2023-29491High
A vulnerability in ncurses before version 6.4 20230408 allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file located in $HOME/.terminfo or accessed via the TERMINFO or TERM environment variable, when used by a setuid application.
- CVE-2022-29458High
In the ncurses library version 6.3 before patch 20220416, an out-of-bounds read and segmentation violation exist in the convert_strings function in tinfo/read_entry.c of the terminfo library.
- CVE-2021-39537High
The ncurses library up to version v6.2-1 contains a heap-based buffer overflow vulnerability in the _nc_captoinfo function in captoinfo.c.
Original NVD description (English source)
Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS