Invisible-Island Ncurses vulnerabilities

CVE-2017-13734 [MEDIUM] CWE-119 CVE-2017-13734: There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

CVE-2022-29458 [HIGH] CWE-125 CVE-2022-29458: ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_st ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

CVE-2019-17595 [MEDIUM] CWE-125 CVE-2019-17595: There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminf There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

CVE-2018-19217 [MEDIUM] CWE-476 CVE-2018-19217: In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_mat In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

CVE-2002-0062 [HIGH] CWE-120 CVE-2002-0062: Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, all Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines for moving the physical cursor and scrolling."

CVE-2019-17594 [MEDIUM] CWE-125 CVE-2019-17594: There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the te There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

CVE-2000-0963 [HIGH] CVE-2000-0963: Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environ Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFO_DIRS.

CVE-2018-19211 [MEDIUM] CWE-476 CVE-2018-19211: In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c tha In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.