Out-of-bounds read in ncurses - CVE-2022-29458

Vulnerability identifier: #VU64274

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29458

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in convert_strings in tinfo/read_entry.c in the terminfo library. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

ncurses
Isolation Segment
VMware Tanzu Application Service for VMs
Data Lakehouse
Netcool Operations Insight
Dell Secure Connect Gateway
IBM Cloud Pak for Business Automation
Red Hat Advanced Cluster Management for Kubernetes
IBM Automation Decision Services
Red Hat build of Keycloak
Amazon Linux AMI
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
macOS
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
Tanzu Greenplum for Kubernetes
DataStax Hyper-Converged Database
cflinuxfs3
Platform Automation Toolkit
Dell PowerProtect Cyber Recovery
VMware Tanzu Operations Manager
Multicluster Engine for Kubernetes
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libncursesw5 (Ubuntu package)
libtinfo5 (Ubuntu package)
ncurses-bin (Ubuntu package)
libncurses5 (Ubuntu package)
libx32ncurses5 (Ubuntu package)
lib32ncursesw5 (Ubuntu package)
lib32tinfo5 (Ubuntu package)
lib32ncurses5 (Ubuntu package)
lib64tinfo5 (Ubuntu package)
lib64ncurses5 (Ubuntu package)
libx32ncursesw5 (Ubuntu package)
libx32tinfo5 (Ubuntu package)
libncurses5
ncurses-devel-debuginfo-32bit
ncurses-devel-32bit
libncurses6-debuginfo-32bit
libncurses6-32bit
libncurses5-debuginfo-32bit
libncurses5-32bit
terminfo-base
terminfo
tack-debuginfo
tack
ncurses-utils-debuginfo
ncurses-utils
libncurses6-debuginfo
libncurses6
libncurses5-debuginfo
ncurses-devel-debuginfo
ncurses-devel
ncurses-debugsource
ncurses-devel-32bit-debuginfo
ncurses5-devel
terminfo-iterm
terminfo-screen
libncurses6-32bit-debuginfo
libncurses5-32bit-debuginfo
ncurses5-devel-32bit
lib32tinfo6 (Ubuntu package)
lib64tinfo6 (Ubuntu package)
lib64ncursesw6 (Ubuntu package)
libncursesw6 (Ubuntu package)
lib64ncurses6 (Ubuntu package)
libtinfo6 (Ubuntu package)
lib32ncursesw6 (Ubuntu package)
libncurses6 (Ubuntu package)
lib32ncurses6 (Ubuntu package)
ncurses
ncurses-base
ncurses-libs
ncurses-help
ncurses-debuginfo
ncurses (Red Hat package)
HPE Moonshot 1500 Chassis Manager
Red Hat Ceph Storage
AMQ Broker

Install patch 20220416 from vendor's repository.

Tanzu Greenplum for Kubernetes - update to 2.0.0
Data Lakehouse - update to 1.1.0.0
DataStax Hyper-Converged Database - update to 1.2.5
Netcool Operations Insight - update to 1.6.15
VMware Tanzu Operations Manager - addressed in versions 2.9.41, 2.10.44, 2.10.59, 3.0.11
Dell Secure Connect Gateway - update to 5.14.00.10
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
libncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libtinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
ncurses-bin (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.0+201602131ubuntu1+esm2, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libx32ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32ncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib32ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib64tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
lib64ncurses5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
libx32ncursesw5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
libx32tinfo5 (Ubuntu package) - addressed in versions Ubuntu Pro, 6.1-1ubuntu1.18.04.1
cflinuxfs3 - update to 0.367.0
Multicluster Engine for Kubernetes - addressed in versions 2.7.6, 2.8.3
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.12.5, 2.13.4
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
Platform Automation Toolkit - addressed in versions 4.4.32, 5.0.25, 5.1.2
libncurses5 - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-devel-debuginfo-32bit - update to 5.9-78.1
ncurses-devel-32bit - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
libncurses6-debuginfo-32bit - update to 5.9-78.1
libncurses6-32bit - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
libncurses5-debuginfo-32bit - update to 5.9-78.1
libncurses5-32bit - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
terminfo-base - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
terminfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
tack-debuginfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
tack - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-utils-debuginfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-utils - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
libncurses6-debuginfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
libncurses6 - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
libncurses5-debuginfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-devel-debuginfo - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-devel - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-debugsource - addressed in versions 5.9-78.1, 6.1-150000.5.12.1
ncurses-devel-32bit-debuginfo - update to 6.1-150000.5.12.1
ncurses5-devel - update to 6.1-150000.5.12.1
terminfo-iterm - update to 6.1-150000.5.12.1
terminfo-screen - update to 6.1-150000.5.12.1
libncurses6-32bit-debuginfo - update to 6.1-150000.5.12.1
libncurses5-32bit-debuginfo - update to 6.1-150000.5.12.1
ncurses5-devel-32bit - update to 6.1-150000.5.12.1
lib32tinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64tinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64ncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib64ncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libtinfo6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib32ncursesw6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
libncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
lib32ncurses6 (Ubuntu package) - addressed in versions 6.2-0ubuntu2.1, 6.3-2ubuntu0.1, 6.3+20220423-2ubuntu0.1, 6.4-2ubuntu0.1
ncurses - update to 6.2-3
ncurses-base - update to 6.2-3
ncurses-libs - update to 6.2-3
ncurses-help - update to 6.2-3
ncurses-devel - update to 6.2-3
ncurses-debugsource - update to 6.2-3
ncurses-debuginfo - update to 6.2-3
ncurses - update to 6.2-4.20200222
ncurses (Red Hat package) - addressed in versions 6.2-8.20210508.el9_0.1, 6.2-8.20210508.el9_2.2, 6.2-10.20210508.el9_4.1
Red Hat Ceph Storage - update to 7.1
AMQ Broker - update to 7.13.2
macOS - update to 13.0 22A380
Dell PowerProtect Cyber Recovery - update to 19.14.0.1
IBM Automation Decision Services - update to 23.0.1 IF003
Red Hat build of Keycloak - update to 26.0.15

• https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.html
• https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.html

• Information disclosure in ncurses
• Ubuntu update for ncurses
• VMware Tanzu products update for ncurses
• SUSE update for ncurses
• SUSE update for ncurses
• Multiple vulnerabilities in Apple macOS Ventura
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Dell EMC Data Protection Central
• Ubuntu update for ncurses
• Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3
• VMware Tanzu products update for ncurses
• Multiple vulnerabilities in Dell PowerProtect Cyber Recovery
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Automation Decision Services
• openEuler update for ncurses
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Amazon Linux AMI update for ncurses
• Gentoo update for ncurses
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Red Hat Ceph Storage 7
• Multiple vulnerabilities in Red Hat build of Keycloak 26.0
• Red Hat Enterprise Linux 9 update for ncurses
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.8
• Red Hat Enterprise Linux 9 update for ncurses
• Red Hat Enterprise Linux 9 update for ncurses
• Multiple vulnerabilities in AMQ Broker 7.13
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.13
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.12
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM DataStax Hyper-Converged Database