Stack-based buffer overflow in ncurses 6.0
Summary
CVE-2017-16879: Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminf... Affects ncurses across 2 version ranges.
< 6.0_p20171125-r0
< ed3eb506e9a8e6ea871a2eb5818e19ba36f3f277
Fixed in 6.0_p20171125-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ncurses is a library that provides terminal-independent access to character screens. It is commonly used to build text-based user interfaces in Unix-like operating systems. This vulnerability affects version 6.0 of ncurses.
Vulnerability Detail
The _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 is susceptible to a stack-based buffer overflow. Attackers can exploit this vulnerability by providing a crafted terminfo file, which can lead to a denial of service (application crash) or potentially execute arbitrary code.
How To Fix
Minimum fixed version
6.0_p20171125-r0
This is the first release that contains the fix.
sudo apk add --upgrade ncursesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the stack-based buffer overflow vulnerability in ncurses 6.0 can result in a denial of service or arbitrary code execution. It is crucial to update to version 6.0_p20171125-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ncurses →
FAQ
ncurses is a library that provides terminal-independent access to character screens. It is commonly used to build text-based user interfaces in Unix-like operating systems.
A stack-based buffer overflow occurs when a program writes more data to a buffer than it can hold, causing the excess data to overflow into adjacent memory locations on the stack.
A terminfo file is a database file used by ncurses to describe the capabilities of different types of terminals.
This vulnerability can lead to a denial of service (application crash) or potentially allow attackers to execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for ncurses.
