CVE-2021-39537

In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.

A buffer overflow vulnerability was found in ncurses 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:70. A remote attacker can cause a denial of service (DoS) by sending a crafted command.

In ncurses 6.1, a buffer overflow vulnerability in the postprocess_terminfo function in tinfo/parse_entry.c:997 allows a remote attacker to cause a denial of service via a crafted command.

A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1116. A remote attacker can cause a denial of service (DoS) by sending a crafted command.

A buffer overflow vulnerability was found in ncurses 6.1 in the fmt_entry function in progs/dump_entry.c:1100. A remote attacker can cause a denial of service (DoS) by sending a crafted command.

A buffer overflow vulnerability was detected in ncurses version 6.1 in the _nc_find_entry function in tinfo/comp_hash.c:66. A remote attacker can cause a denial of service via a crafted command.

A buffer overflow vulnerability was found in ncurses 6.1 in the one_one_mapping function in progs/dump_entry.c:1373. A remote attacker can cause a denial of service (DoS) by sending a crafted command.

A vulnerability in ncurses before version 6.4 20230408 allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file located in $HOME/.terminfo or accessed via the TERMINFO or TERM environment variable, when used by a setuid application.

In the ncurses library version 6.3 before patch 20220416, an out-of-bounds read and segmentation violation exist in the convert_strings function in tinfo/read_entry.c of the terminfo library.