Input validation error in ncurses - CVE-2023-50495

Vulnerability identifier: #VU84723

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-50495

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the _nc_wrap_entry() function. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

ncurses
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Ubuntu
Legacy Module
Basesystem Module
Development Tools Module
openSUSE Leap
openEuler
Anolis OS
Fedora
Guardium Data Security Center (GDSC)
ObjectScale
Storage Resource Manager
Cloud Pak for Data System - Cyclops
lib32ncurses5 (Ubuntu package)
lib32tinfo5 (Ubuntu package)
lib64ncurses5 (Ubuntu package)
lib64tinfo5 (Ubuntu package)
libncurses5 (Ubuntu package)
libtinfo5 (Ubuntu package)
libx32ncurses5 (Ubuntu package)
libx32tinfo5 (Ubuntu package)
ncurses-devel-debuginfo-32bit
libncurses6-32bit
ncurses-devel-debuginfo
terminfo
ncurses-devel
ncurses-debugsource
terminfo-base
libncurses6-debuginfo
ncurses-utils
ncurses-utils-debuginfo
libncurses5-debuginfo-32bit
tack
libncurses5
tack-debuginfo
libncurses6
libncurses5-debuginfo
ncurses-devel-32bit
libncurses6-debuginfo-32bit
libncurses5-32bit
terminfo-iterm
ncurses5-devel
ncurses-devel-32bit-debuginfo
libncurses5-32bit-debuginfo
ncurses5-devel-32bit
libncurses6-32bit-debuginfo
terminfo-screen
ncurses
ncurses-base
ncurses-libs
ncurses-help
ncurses-debuginfo
ncurses-term
ncurses-doc
ncurses-static
ncurses-compat-libs
ncurses-c++-libs
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Azure Stack
Dell EMC Storage Monitoring and Reporting (SMR)

Install update from vendor's website.

ncurses - update to 6.4 20230424
Guardium Data Security Center (GDSC) - update to 3.6.1
lib32ncurses5 (Ubuntu package) - update to Ubuntu Pro
lib32tinfo5 (Ubuntu package) - update to Ubuntu Pro
lib64ncurses5 (Ubuntu package) - update to Ubuntu Pro
lib64tinfo5 (Ubuntu package) - update to Ubuntu Pro
libncurses5 (Ubuntu package) - update to Ubuntu Pro
libtinfo5 (Ubuntu package) - update to Ubuntu Pro
libx32ncurses5 (Ubuntu package) - update to Ubuntu Pro
libx32tinfo5 (Ubuntu package) - update to Ubuntu Pro
ObjectScale - update to 1.4.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.4
Storage Resource Manager - update to 4.10.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
App Connect Enterprise Certified Container - addressed in versions 5.0.18, 11.6.0
ncurses-devel-debuginfo-32bit - update to 5.9-85.1
libncurses6-32bit - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-devel-debuginfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
terminfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-devel - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-debugsource - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
terminfo-base - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses6-debuginfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-utils - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-utils-debuginfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses5-debuginfo-32bit - update to 5.9-85.1
tack - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses5 - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
tack-debuginfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses6 - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses5-debuginfo - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
ncurses-devel-32bit - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
libncurses6-debuginfo-32bit - update to 5.9-85.1
libncurses5-32bit - addressed in versions 5.9-85.1, 6.1-150000.5.20.1
terminfo-iterm - update to 6.1-150000.5.20.1
ncurses5-devel - update to 6.1-150000.5.20.1
ncurses-devel-32bit-debuginfo - update to 6.1-150000.5.20.1
libncurses5-32bit-debuginfo - update to 6.1-150000.5.20.1
ncurses5-devel-32bit - update to 6.1-150000.5.20.1
libncurses6-32bit-debuginfo - update to 6.1-150000.5.20.1
terminfo-screen - update to 6.1-150000.5.20.1
ncurses - update to 6.2-4.20200222
ncurses-base - update to 6.2-5
ncurses-debugsource - update to 6.2-5
ncurses-libs - update to 6.2-5
ncurses-help - update to 6.2-5
ncurses-debuginfo - update to 6.2-5
ncurses - update to 6.2-5
ncurses-devel - update to 6.2-5
ncurses - update to 6.4-3.20240127
ncurses-term - update to 6.4-3.20240127
ncurses-doc - update to 6.4-3.20240127
ncurses-base - update to 6.4-3.20240127
ncurses-static - update to 6.4-3.20240127
ncurses-libs - update to 6.4-3.20240127
ncurses-devel - update to 6.4-3.20240127
ncurses-compat-libs - update to 6.4-3.20240127
ncurses-c++-libs - update to 6.4-3.20240127
ncurses - update to 6.4-7.20230520.fc38
Azure Stack - update to 10.2402
Cloud Pak for Data System - Cyclops - update to 11.3.1.1

• https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html
• https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html

• Denial of service in ncurses
• SUSE update for ncurses
• SUSE update for ncurses
• Fedora 38 update for ncurses
• Ubuntu update for ncurses
• openEuler update for ncurses
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure and Dell APEX Cloud Platform Foundation Software
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Amazon Linux AMI update for ncurses
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in Guardium Data Security Center
• Anolis OS update for ncurses
• Multiple vulnerabilities in IBM Cloud Pak for Data System - Cyclops