Test ID:	1.3.6.1.4.1.25623.1.1.12.2022.5477.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-5477-1)
Summary:	The remote host is missing an update for the 'ncurses' package(s) announced via the USN-5477-1 advisory.
Description:	Summary: The remote host is missing an update for the 'ncurses' package(s) announced via the USN-5477-1 advisory. Vulnerability Insight: Hosein Askari discovered that ncurses was incorrectly performing memory management operations when dealing with long filenames while writing structures into the file system. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-16879) Chung-Yi Lin discovered that ncurses was incorrectly handling access to invalid memory areas when parsing terminfo or termcap entries where the use-name had invalid syntax. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19211) It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17594) It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17595) It was discovered that ncurses was incorrectly handling end-of-string characters when converting between termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-39537) It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2022-29458) Affected Software/OS: 'ncurses' package(s) on Ubuntu 14.04, Ubuntu 16.04. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-16879 https://security.gentoo.org/glsa/201804-13 http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E Common Vulnerability Exposure (CVE) ID: CVE-2018-19211 https://bugzilla.redhat.com/show_bug.cgi?id=1643754 Common Vulnerability Exposure (CVE) ID: CVE-2019-17594 https://security.gentoo.org/glsa/202101-28 https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.html https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html SuSE Security Announcement: openSUSE-SU-2019:2550 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html SuSE Security Announcement: openSUSE-SU-2019:2551 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html Common Vulnerability Exposure (CVE) ID: CVE-2019-17595 https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html Common Vulnerability Exposure (CVE) ID: CVE-2021-39537 http://seclists.org/fulldisclosure/2022/Oct/28 http://seclists.org/fulldisclosure/2022/Oct/41 http://seclists.org/fulldisclosure/2022/Oct/43 http://seclists.org/fulldisclosure/2022/Oct/45 http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html Common Vulnerability Exposure (CVE) ID: CVE-2022-29458 https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.html https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.html https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.