CVE-2018-9240: Null Pointer Dereference

Q: Who is exposed to this denial-of-service issue?

Users running ncmpc through version 0.29 are exposed when they use its chat screen. The affected software listings include Debian and Ubuntu ncmpc packages.

Q: What must an attacker do to trigger the crash?

Another client must send a long chat message while the targeted user is using the chat screen. No attacker privileges or user interaction are indicated by the supplied CVSS vector.

Q: What is the impact of successful exploitation?

The flaw can crash ncmpc through a NULL pointer dereference, causing denial of service. The supplied CVSS vector indicates availability impact only, with no confidentiality or integrity impact.

Published Apr 3, 2018

Updated

Last updated 11 February 2026

Other sources

ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.

— Launchpad

Affected Software

6 affected componentsFixes available

Ncmpc Project Ncmpc<=0.29

Debian Debian Linux=8.0

Canonical Ubuntu Linux=16.04

debian/ncmpc

0.45-10.47-20.52-1

ubuntu/ncmpc<0.24-1+deb8u1build0.16.04.1

0.24-1+deb8u1build0.16.04.1

ubuntu/ncmpc<0.27-1ubuntu0.1~esm1

0.27-1ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ncmpc to a version that resolves this vulnerability.
Fixed in 0.45-1Fixed in 0.47-2Fixed in 0.52-1
Upgrade
Upgrade ubuntu/ncmpc to a version that resolves this vulnerability.
Fixed in 0.24-1+deb8u1build0.16.04.1
Upgrade
Upgrade ubuntu/ncmpc to a version that resolves this vulnerability.
Fixed in 0.27-1ubuntu0.1~esm1
Upgrade
Upgrade ncmpc to a version that resolves this vulnerability.
Fixed in 0.29

Event History

Apr 3, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Data Sourced

via OSV·10:29 PM

DescriptionSeverityAffected Software

Data Sourced

via NVD·10:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

Users running ncmpc through version 0.29 are exposed when they use its chat screen. The affected software listings include Debian and Ubuntu ncmpc packages.

What must an attacker do to trigger the crash?

Another client must send a long chat message while the targeted user is using the chat screen. No attacker privileges or user interaction are indicated by the supplied CVSS vector.

What is the impact of successful exploitation?

The flaw can crash ncmpc through a NULL pointer dereference, causing denial of service. The supplied CVSS vector indicates availability impact only, with no confidentiality or integrity impact.

CVE-2018-9240: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this denial-of-service issue?

What must an attacker do to trigger the crash?

What is the impact of successful exploitation?