CVE-2019-15548
published 2019-08-26CVE-2019-15548: An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is…
PriorityP341critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.62%
73.3th percentile
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | ncurses | 0 – 5.101.0 | — |
| gnu | ncurses | >= 0.0.0-0 | — |
| ncurses_project | ncurses | <= 5.99.0 | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Mishandling of format strings in ncurses
osv·2021-08-25
CVE-2019-15547 [HIGH] Mishandling of format strings in ncurses
Mishandling of format strings in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
GHSA
Buffer overflow and format vulnerabilities in ncurses
ghsa·2021-08-25
CVE-2019-15548 [CRITICAL] CWE-119 Buffer overflow and format vulnerabilities in ncurses
Buffer overflow and format vulnerabilities in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
OSV
Buffer overflow and format vulnerabilities in ncurses
osv·2021-08-25
CVE-2019-15547 [CRITICAL] Buffer overflow and format vulnerabilities in ncurses
Buffer overflow and format vulnerabilities in ncurses
ncurses exposes functions from the ncurses library which:
* Pass buffers without length to C functions that may write an arbitrary amount of data, leading to a buffer overflow. (instr, mvwinstr, etc)
* Passes rust &str to strings expecting C format arguments, allowing hostile input to execute a format string attack, which trivially allows writing arbitrary data to stack memory (functions in the printw family).
OSV
CVE-2019-15548: An issue was discovered in the ncurses crate through 5
osv·2019-08-26·CVSS 9.8
CVE-2019-15548 [CRITICAL] CVE-2019-15548: An issue was discovered in the ncurses crate through 5
An issue was discovered in the ncurses crate through 5.99.0 for Rust. There are instr and mvwinstr buffer overflows because interaction with C functions is mishandled.
OSV
Buffer overflow and format vulnerabilities in functions exposed without unsafe
osv·2019-06-15
CVE-2019-15547 Buffer overflow and format vulnerabilities in functions exposed without unsafe
Buffer overflow and format vulnerabilities in functions exposed without unsafe
`ncurses` exposes functions from the ncurses library which:
- Pass buffers without length to C functions that may write an arbitrary amount of
data, leading to a buffer overflow. (`instr`, `mvwinstr`, etc)
- Passes rust &str to strings expecting C format arguments, allowing hostile
input to execute a format string attack, which trivially allows writing
arbitrary data to stack memory (functions in the `printw` family).
No detection rules found.
No public exploits indexed.
2019-08-26
Published