CVE-2019-15547
published 2019-08-26CVE-2019-15547: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are…
PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EPSS
1.23%
65.5th percentile
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | ncurses | 0 – 5.101.0 | — |
| gnu | ncurses | >= 0.0.0-0 | — |
| ncurses_project | ncurses | <= 5.99.0 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mishandling of format strings in ncurses
osv·2021-08-25
CVE-2019-15547 [HIGH] Mishandling of format strings in ncurses
Mishandling of format strings in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
GHSA
Mishandling of format strings in ncurses
ghsa·2021-08-25
CVE-2019-15547 [HIGH] CWE-134 Mishandling of format strings in ncurses
Mishandling of format strings in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
OSV
Buffer overflow and format vulnerabilities in ncurses
osv·2021-08-25
CVE-2019-15547 [CRITICAL] Buffer overflow and format vulnerabilities in ncurses
Buffer overflow and format vulnerabilities in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
OSV
CVE-2019-15547: An issue was discovered in the ncurses crate through 5
osv·2019-08-26·CVSS 7.5
CVE-2019-15547 [HIGH] CVE-2019-15547: An issue was discovered in the ncurses crate through 5
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are format string issues in printw functions because C format arguments are mishandled.
OSV
Buffer overflow and format vulnerabilities in functions exposed without unsafe
osv·2019-06-15
CVE-2019-15547 Buffer overflow and format vulnerabilities in functions exposed without unsafe
Buffer overflow and format vulnerabilities in functions exposed without unsafe
`ncurses` exposes functions from the ncurses library which:
- Pass buffers without length to C functions that may write an arbitrary amount of
data, leading to a buffer overflow. (`instr`, `mvwinstr`, etc)
- Passes rust &str to strings expecting C format arguments, allowing hostile
input to execute a format string attack, which trivially allows writing
arbitrary data to stack memory (functions in the `printw` family).
No detection rules found.
No public exploits indexed.
2019-08-26
Published