CVE-2018-19211: In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product…

medium5.5CVSS 3.0

AVLACLPRNUIRSUCNINAH

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	ncurses	< ncurses 6.1+20180210-3 (bookworm)	ncurses 6.1+20180210-3 (bookworm)
gnu	ncurses	—	—
gnu	ncurses	>= 0 < 6.1+20180210-3	6.1+20180210-3
gnu	ncurses	>= 0 < 6.1+20180210-3	6.1+20180210-3
gnu	ncurses	>= 0 < 6.1+20180210-3	6.1+20180210-3
gnu	ncurses	>= 0 < 6.1+20180210-3	6.1+20180210-3
gnu	ncurses	>= 0 < 5.9+20140118-1ubuntu1+esm2	5.9+20140118-1ubuntu1+esm2
gnu	ncurses	>= 0 < 6.0+20160213-1ubuntu1+esm2	6.0+20160213-1ubuntu1+esm2

CVSS provenance

nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

osv7.8HIGH