Bugzilla – Bug 1115929
VUL-1: CVE-2018-19211: ncurses: There is a Segmentation fault on unknown address in function _nc_parse_entry in libncurses.
Last modified: 2020-07-10 14:42:25 UTC
rh#1643754 In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. References: https://bugzilla.redhat.com/show_bug.cgi?id=1643754 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-19211
Created attachment 789630 [details] poc1 QA REPRODUCER: captoinfo poc1 should not crash
tumbleweed 6.1 does not crash 42.3 ncurses 5.x crahes
Hmm it does not crash but report errors on both tumbleweed and Leap15 werner/ncurses> captoinfo -o /tmp/xxx checks/poc1 "checks/poc1", line 1, col 32: dubious character `*' in name or alias field "checks/poc1", line 1, col 32: invalid entry name "a*??*??????j???5" [...] a*??*??????j???5, bel=^G, cr=\r, cud1=\n, ht=^I, ind=\n, kbs=^H, kcub1=^H, kcud1=\n, nel=\r\n, j??5, acsc=, bel=^G, cr=\r, cud1=\n, ht=^I, ind=\n, kbs=^H, kcub1=^H, kcud1=\n, nel=\r\n, rs2=,
(In reply to Marcus Meissner from comment #2) > tumbleweed 6.1 does not crash > 42.3 ncurses 5.x crahes Indeed this crash on SLE-12 with latest ncurses
Btw: captoinfo is part of package ncurses-devel
FIXED with SR#178044
SUSE-SU-2018:3967-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1115929 CVE References: CVE-2018-19211 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP4 (src): ncurses-5.9-61.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): ncurses-5.9-61.1 SUSE Linux Enterprise Server 12-SP4 (src): ncurses-5.9-61.1 SUSE Linux Enterprise Server 12-SP3 (src): ncurses-5.9-61.1 SUSE Linux Enterprise Desktop 12-SP4 (src): ncurses-5.9-61.1 SUSE Linux Enterprise Desktop 12-SP3 (src): ncurses-5.9-61.1 SUSE CaaS Platform ALL (src): ncurses-5.9-61.1 SUSE CaaS Platform 3.0 (src): ncurses-5.9-61.1 OpenStack Cloud Magnum Orchestration 7 (src): ncurses-5.9-61.1
SUSE-SU-2018:4000-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1103320,1115929 CVE References: CVE-2018-19211 Sources used: SUSE Linux Enterprise Module for Legacy Software 15 (src): ncurses-6.1-5.3.1 SUSE Linux Enterprise Module for Development Tools 15 (src): ncurses-6.1-5.3.1 SUSE Linux Enterprise Module for Basesystem 15 (src): ncurses-6.1-5.3.1
openSUSE-SU-2018:4034-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1115929 CVE References: CVE-2018-19211 Sources used: openSUSE Leap 42.3 (src): ncurses-5.9-66.1
openSUSE-SU-2018:4055-1: An update that solves one vulnerability and has one errata is now available. Category: security (important) Bug References: 1103320,1115929 CVE References: CVE-2018-19211 Sources used: openSUSE Leap 15.0 (src): ncurses-6.1-lp150.4.3.1
Done