Out-of-bounds write in ncurses - CVE-2021-39537

Vulnerability identifier: #VU57577

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39537

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

ncurses
Isolation Segment
VMware Tanzu Application Service for VMs
Dell Secure Connect Gateway
Amazon Linux AMI
SUSE MicroOS
macOS
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server
Ubuntu
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
openEuler
Tanzu Greenplum for Kubernetes
Dell EMC PowerProtect Data Protection
SmartFabric OS10
webMethods Managed File Transfer
cflinuxfs3
Enterprise SONiC
Platform Automation Toolkit
VMware Tanzu Operations Manager
RecoverPoint for Virtual Machines
libx32ncurses5 (Ubuntu package)
lib32tinfo5 (Ubuntu package)
lib32ncurses5 (Ubuntu package)
lib64tinfo5 (Ubuntu package)
lib64ncurses5 (Ubuntu package)
libx32ncursesw5 (Ubuntu package)
libx32tinfo5 (Ubuntu package)
lib32ncursesw5 (Ubuntu package)
libncurses5 (Ubuntu package)
ncurses-bin (Ubuntu package)
libtinfo5 (Ubuntu package)
libncursesw5 (Ubuntu package)
tack
ncurses-devel-debuginfo-32bit
tack-debuginfo
terminfo
terminfo-base
libncurses5-32bit
libncurses5-debuginfo-32bit
libncurses6-32bit
libncurses6-debuginfo-32bit
ncurses-devel-32bit
ncurses-utils-debuginfo
ncurses-utils
libncurses6-debuginfo
libncurses6
libncurses5-debuginfo
libncurses5
ncurses-devel-debuginfo
ncurses-devel
ncurses-debugsource
terminfo-screen
libncurses6-32bit-debuginfo
ncurses-devel-32bit-debuginfo
libncurses5-32bit-debuginfo
terminfo-iterm
ncurses5-devel
libncurses6 (Ubuntu package)
lib64ncursesw6 (Ubuntu package)
libncursesw6 (Ubuntu package)
lib64ncurses6 (Ubuntu package)
lib64tinfo6 (Ubuntu package)
libtinfo6 (Ubuntu package)
lib32ncurses6 (Ubuntu package)
lib32tinfo6 (Ubuntu package)
lib32ncursesw6 (Ubuntu package)
ncurses-debuginfo
ncurses-help
ncurses-libs
ncurses-base
ncurses
HPE Moonshot 1500 Chassis Manager

Install update from vendor's website.

ncurses - update to 6.3
Tanzu Greenplum for Kubernetes - update to 2.0.0
Dell EMC PowerProtect Data Protection - update to 2.7.8
VMware Tanzu Operations Manager - addressed in versions 2.9.41, 2.10.44, 2.10.59, 3.0.11
Dell Secure Connect Gateway - update to 5.14.00.10
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
macOS - addressed in versions 11.7 20G817, 12.6 21G115, 13.0 22A380
libx32ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib64tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib64ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
libx32ncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
libx32tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32ncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
libncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
ncurses-bin (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libtinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
cflinuxfs3 - update to 0.367.0
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
Enterprise SONiC - update to 4.2.1
Platform Automation Toolkit - addressed in versions 4.4.32, 5.0.25, 5.1.2
tack - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-devel-debuginfo-32bit - update to 5.9-75.1
tack-debuginfo - addressed in versions 5.9-75.1, 6.1-5.9.1
terminfo - addressed in versions 5.9-75.1, 6.1-5.9.1
terminfo-base - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses5-32bit - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses5-debuginfo-32bit - update to 5.9-75.1
libncurses6-32bit - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses6-debuginfo-32bit - update to 5.9-75.1
ncurses-devel-32bit - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-utils-debuginfo - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-utils - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses6-debuginfo - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses6 - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses5-debuginfo - addressed in versions 5.9-75.1, 6.1-5.9.1
libncurses5 - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-devel-debuginfo - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-devel - addressed in versions 5.9-75.1, 6.1-5.9.1
ncurses-debugsource - addressed in versions 5.9-75.1, 6.1-5.9.1
terminfo-screen - update to 6.1-5.9.1
libncurses6-32bit-debuginfo - update to 6.1-5.9.1
ncurses-devel-32bit-debuginfo - update to 6.1-5.9.1
libncurses5-32bit-debuginfo - update to 6.1-5.9.1
terminfo-iterm - update to 6.1-5.9.1
ncurses5-devel - update to 6.1-5.9.1
libncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64ncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64ncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64tinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libtinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib32ncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib32tinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib32ncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
ncurses-debuginfo - update to 6.2-2
ncurses-help - update to 6.2-2
ncurses-libs - update to 6.2-2
ncurses-debugsource - update to 6.2-2
ncurses-devel - update to 6.2-2
ncurses-base - update to 6.2-2
ncurses - update to 6.2-2
ncurses - update to 6.2-4.20200222

• https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html
• https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html
• http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup

• Remote code execution in ncurses
• Ubuntu update for ncurses
• SUSE update for ncurses
• SUSE update for ncurses
• VMware Tanzu products update for ncurses
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Apple macOS Big Sur
• Multiple vulnerabilities in Apple macOS Monterey
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Ubuntu update for ncurses
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• VMware Tanzu products update for ncurses
• openEuler update for ncurses
• Multiple vulnerabilities in Dell Networking OS10
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Dell SmartFabric OS10
• Amazon Linux AMI update for ncurses
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• PowerProtect Data Protection software update for third-party components
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Dell RecoverPoint for Virtual Machines update for third-party components