SB2018111702 - Denial of service in ncurses

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Null pointer dereference (CVE-ID: CVE-2018-19217)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference condition in the _nc_name_match function when handling maliciou input. A remote attacker can trick the victim into opening a specially crafted file that submits malicious input, trigger a NULL pointer dereference condition and cause the service to crash.

2) Null pointer dereference (CVE-ID: CVE-2018-19211)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference condition in the _nc_write_entry function when handling maliciou input. A remote attacker can trick the victim into opening a specially crafted file that submits malicious input, trigger a NULL pointer dereference condition and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1643753
• https://bugzilla.redhat.com/show_bug.cgi?id=1643754