CVE-2017-16879

MEDIUM

Description

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

References

http://invisible-island.net/ncurses/NEWS.html#t20171125

http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html

https://security.gentoo.org/glsa/201804-13

https://tools.cisco.com/security/center/viewAlert.x?alertId=57695

Details

Source: MITRE

Published: 2017-11-22

Updated: 2021-03-25

Type: CWE-787

Risk Information

CVSS v2.0

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:gnu:ncurses:6.0:*:*:*:*:*:*:*

Tenable Plugins

View all (8 total)

IDNameProductFamilySeverity
121781Photon OS 1.0: Ncurses PHSA-2017-1.0-0093NessusPhotonOS Local Security Checks
high
121777Photon OS 2.0: Ncurses PHSA-2017-0053NessusPhotonOS Local Security Checks
medium
111903Photon OS 1.0: Apr / Krb5 / Linux / Ncurses / Subversion PHSA-2017-1.0-0093 (deprecated)NessusPhotonOS Local Security Checks
high
111902Photon OS 2.0: Apr / Ncurses PHSA-2017-0053 (deprecated)NessusPhotonOS Local Security Checks
medium
109097GLSA-201804-13 : ncurses: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
106147EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2018-1006)NessusHuawei Local Security Checks
medium
106146EulerOS 2.0 SP1 : ncurses (EulerOS-SA-2018-1005)NessusHuawei Local Security Checks
medium
104993SUSE SLES11 Security Update : ncurses (SUSE-SU-2017:3183-1)NessusSuSE Local Security Checks
medium