CVE-2022-29458
HIGH severity · CVSS 7.1 · Out-of-bounds read
7.1CVSS HIGH
Summary
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
Confidentiality impactHigh
Integrity impactNone
Availability impactHigh
Exploit probability (EPSS)1%
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.htmlAdvisory
- https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.htmlAdvisory
- http://seclists.org/fulldisclosure/2022/Oct/28
- http://seclists.org/fulldisclosure/2022/Oct/41Advisory
- https://lists.debian.org/debian-lts-announce/2022/10/msg00037.htmlAdvisory
- https://support.apple.com/kb/HT213488Advisory