A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocesstermcap of the file tinfo/parseentry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
Accessibility. A privacy issue was addressed with improved private data redaction for log entries.
GNU ncurses could allow a remote attacker to obtain sensitive information, caused by a heap-based buffer over-read in the ncfindentry function in tinfo/comphash.c in the terminfo library. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to obtain sensitive information.
GNU ncurses could allow a remote attacker to obtain sensitive information, caused by a heap-based buffer over-read in the fmtentry function in tinfo/comphash.c in the terminfo library. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to obtain sensitive information.
DISPUTED In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function ncnamematch that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.
In ncurses 6.1, there is a NULL pointer dereference at function ncparseentry in parseentry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character ' in name or alias field" detection.
There is an illegal address access in the ncsavestr function in allocentry.c in ncurses 6.0. It will lead to a remote denial of service attack.
There is an illegal address access in the function ncreadentrysource() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.
There is an illegal address access in the function dumpuses() in progs/dumpentry.c in ncurses 6.0 that might lead to a remote denial of service attack.
There is an illegal address access in the ncsafestrcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.
There is an illegal address access in the function postprocesstermcap() in parseentry.c in ncurses 6.0 that will lead to a remote denial of service attack.
There is an illegal address access in the fmtentry function in progs/dumpentry.c in ncurses 6.0 that might lead to a remote denial of service attack.