UBUNTU-CVE-2018-9240: Null Pointer Dereference

Q: Which deployments are exposed to this issue?

Systems running ncmpc version 0.29 or earlier are affected when a user uses the chat screen. The issue is specific to processing a long chat message sent by another client.

Q: What does an attacker need to do to trigger the denial of service?

The attacker needs to send a long chat message from another client while the targeted ncmpc user is using the chat screen. The provided CVSS vector indicates network reachability, low attack complexity, no required privileges, and no user interaction.

Q: What is the expected security impact?

Successful exploitation can crash ncmpc, causing a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

Published Apr 3, 2018

Updated

ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial of service could occur.

Affected Software

2 affected componentsFixes available

ubuntu/ncmpc<0.24-1+deb8u1build0.16.04.1

0.24-1+deb8u1build0.16.04.1

ubuntu/ncmpc<0.27-1ubuntu0.1~esm1

0.27-1ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/ncmpc to a version that resolves this vulnerability.
Fixed in 0.24-1+deb8u1build0.16.04.1
Upgrade
Upgrade ubuntu/ncmpc to a version that resolves this vulnerability.
Fixed in 0.27-1ubuntu0.1~esm1

Event History

Apr 3, 2018

CVE Published

via OSV·10:29 PM

Data Sourced

via OSV·10:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Systems running ncmpc version 0.29 or earlier are affected when a user uses the chat screen. The issue is specific to processing a long chat message sent by another client.

What does an attacker need to do to trigger the denial of service?

The attacker needs to send a long chat message from another client while the targeted ncmpc user is using the chat screen. The provided CVSS vector indicates network reachability, low attack complexity, no required privileges, and no user interaction.

What is the expected security impact?

Successful exploitation can crash ncmpc, causing a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.

UBUNTU-CVE-2018-9240: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to trigger the denial of service?

What is the expected security impact?