Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

This update for ncurses fixes the following issues :

Security issue fixed :

CVE-2018-10754: Fixed a denial of service caused by a NULL pointer Dereference in the _nc_parse_entry() (bsc#1131830).

CVE-2019-17594: Fixed a heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c (bsc#1154036).

CVE-2019-17595: Fixed a heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c (bsc#1154037).

Bug fixes: Fixed ppc64le build configuration (bsc#1134550).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ncurses packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference was found in the way the
    _nc_parse_entry function parses terminfo data for     compilation. An attacker able to provide specially     crafted terminfo data could use this flaw to crash the     application parsing it.(CVE-2018-10754)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of 'ncurses' packages of Photon OS has been released.

An update of 'ncurses', 'strongswan' packages of Photon OS has been released.

According to the version of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference was found in the way the
    _nc_parse_entry function parses terminfo data for     compilation. An attacker able to provide specially     crafted terminfo data could use this flaw to crash the     application parsing it.(CVE-2018-10754)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference was found in the way the _nc_parse_entry function parses terminfo data for compilation. An attacker able to provide specially crafted terminfo data could use this flaw to crash the application parsing it.(CVE-2018-10754)

ID	Name	Product	Family	Severity
131555	SUSE SLED12 / SLES12 Security Update : ncurses (SUSE-SU-2019:3094-1)	Nessus	SuSE Local Security Checks	medium
118426	EulerOS Virtualization 2.5.0 : ncurses (EulerOS-SA-2018-1338)	Nessus	Huawei Local Security Checks	high
117430	EulerOS Virtualization 2.5.2 : ncurses (EulerOS-SA-2018-1276)	Nessus	Huawei Local Security Checks	high
111958	Photon OS 2.0: Ncurses PHSA-2018-2.0-0074 (deprecated)	Nessus	PhotonOS Local Security Checks	high
111944	Photon OS 1.0: Ncurses / Strongswan PHSA-2018-1.0-0164 (deprecated)	Nessus	PhotonOS Local Security Checks	high
111645	EulerOS 2.0 SP3 : ncurses (EulerOS-SA-2018-1225)	Nessus	Huawei Local Security Checks	high
111607	Amazon Linux 2 : ncurses (ALAS-2018-1053)	Nessus	Amazon Linux Local Security Checks	high
110882	EulerOS 2.0 SP2 : ncurses (EulerOS-SA-2018-1218)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2018-10754

No Score

Tenable Plugins

medium

high

high

high

high

high

high

high