[gentoo-announce] [ GLSA 201804-13 ] ncurses: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201804-13 ] ncurses: Multiple vulnerabilities
Date:	Tue, 17 Apr 2018 18:25:05
Message-Id:	`20180417181939.GA10079@monkey`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201804-13

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: ncurses: Multiple vulnerabilities

9

     Date: April 17, 2018

10

     Bugs: #624644, #625830, #629276, #639706

11

       ID: 201804-13

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in ncurses, the worst of which

19

allows remote attackers to execute arbitrary code.

20

21

Background

22

==========

23

24

Free software emulation of curses in System V.

25

26

Affected packages

27

=================

28

29

    -------------------------------------------------------------------

30

     Package              /     Vulnerable     /            Unaffected

31

    -------------------------------------------------------------------

32

  1  sys-libs/ncurses             < 6.1:0                    >= 6.1:0

33

34

Description

35

===========

36

37

Multiple vulnerabilities have been discovered in ncurses. Please review

38

the CVE identifiers referenced below for details.

39

40

Impact

41

======

42

43

A remote attacker, by enticing the user to process untrusted terminfo

44

or other data, could execute arbitrary code or cause a Denial of

45

Service condition.

46

47

Workaround

48

==========

49

50

There is no known workaround at this time.

51

52

Resolution

53

==========

54

55

All ncurses users should upgrade to the latest version:

56

57

  # emerge --sync

58

  # emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.1:0"

59

60

References

61

==========

62

63

[  1 ] CVE-2017-10684

64

       https://nvd.nist.gov/vuln/detail/CVE-2017-10684

65

[  2 ] CVE-2017-10685

66

       https://nvd.nist.gov/vuln/detail/CVE-2017-10685

67

[  3 ] CVE-2017-11112

68

       https://nvd.nist.gov/vuln/detail/CVE-2017-11112

69

[  4 ] CVE-2017-11113

70

       https://nvd.nist.gov/vuln/detail/CVE-2017-11113

71

[  5 ] CVE-2017-13728

72

       https://nvd.nist.gov/vuln/detail/CVE-2017-13728

73

[  6 ] CVE-2017-13729

74

       https://nvd.nist.gov/vuln/detail/CVE-2017-13729

75

[  7 ] CVE-2017-13730

76

       https://nvd.nist.gov/vuln/detail/CVE-2017-13730

77

[  8 ] CVE-2017-13731

78

       https://nvd.nist.gov/vuln/detail/CVE-2017-13731

79

[  9 ] CVE-2017-13732

80

       https://nvd.nist.gov/vuln/detail/CVE-2017-13732

81

[ 10 ] CVE-2017-13733

82

       https://nvd.nist.gov/vuln/detail/CVE-2017-13733

83

[ 11 ] CVE-2017-13734

84

       https://nvd.nist.gov/vuln/detail/CVE-2017-13734

85

[ 12 ] CVE-2017-16879

86

       https://nvd.nist.gov/vuln/detail/CVE-2017-16879

87

88

Availability

89

============

90

91

This GLSA and any updates to it are available for viewing at

92

the Gentoo Security Website:

93

94

 https://security.gentoo.org/glsa/201804-13

95

96

Concerns?

97

=========

98

99

Security is a primary focus of Gentoo Linux and ensuring the

100

confidentiality and security of our users' machines is of utmost

101

importance to us. Any security concerns should be addressed to

102

security@g.o or alternatively, you may file a bug at

103

https://bugs.gentoo.org.

104

105

License

106

=======

107

108

Copyright 2018 Gentoo Foundation, Inc; referenced text

109

belongs to its owner(s).

110

111

The contents of this document are licensed under the

112

Creative Commons - Attribution / Share Alike license.

113

114

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201804-13
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: ncurses: Multiple vulnerabilities
9	Date: April 17, 2018
10	Bugs: #624644, #625830, #629276, #639706
11	ID: 201804-13
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in ncurses, the worst of which
19	allows remote attackers to execute arbitrary code.
20
21	Background
22	==========
23
24	Free software emulation of curses in System V.
25
26	Affected packages
27	=================
28
29	-------------------------------------------------------------------
30	Package / Vulnerable / Unaffected
31	-------------------------------------------------------------------
32	1 sys-libs/ncurses < 6.1:0 >= 6.1:0
33
34	Description
35	===========
36
37	Multiple vulnerabilities have been discovered in ncurses. Please review
38	the CVE identifiers referenced below for details.
39
40	Impact
41	======
42
43	A remote attacker, by enticing the user to process untrusted terminfo
44	or other data, could execute arbitrary code or cause a Denial of
45	Service condition.
46
47	Workaround
48	==========
49
50	There is no known workaround at this time.
51
52	Resolution
53	==========
54
55	All ncurses users should upgrade to the latest version:
56
57	# emerge --sync
58	# emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.1:0"
59
60	References
61	==========
62
63	[ 1 ] CVE-2017-10684
64	https://nvd.nist.gov/vuln/detail/CVE-2017-10684
65	[ 2 ] CVE-2017-10685
66	https://nvd.nist.gov/vuln/detail/CVE-2017-10685
67	[ 3 ] CVE-2017-11112
68	https://nvd.nist.gov/vuln/detail/CVE-2017-11112
69	[ 4 ] CVE-2017-11113
70	https://nvd.nist.gov/vuln/detail/CVE-2017-11113
71	[ 5 ] CVE-2017-13728
72	https://nvd.nist.gov/vuln/detail/CVE-2017-13728
73	[ 6 ] CVE-2017-13729
74	https://nvd.nist.gov/vuln/detail/CVE-2017-13729
75	[ 7 ] CVE-2017-13730
76	https://nvd.nist.gov/vuln/detail/CVE-2017-13730
77	[ 8 ] CVE-2017-13731
78	https://nvd.nist.gov/vuln/detail/CVE-2017-13731
79	[ 9 ] CVE-2017-13732
80	https://nvd.nist.gov/vuln/detail/CVE-2017-13732
81	[ 10 ] CVE-2017-13733
82	https://nvd.nist.gov/vuln/detail/CVE-2017-13733
83	[ 11 ] CVE-2017-13734
84	https://nvd.nist.gov/vuln/detail/CVE-2017-13734
85	[ 12 ] CVE-2017-16879
86	https://nvd.nist.gov/vuln/detail/CVE-2017-16879
87
88	Availability
89	============
90
91	This GLSA and any updates to it are available for viewing at
92	the Gentoo Security Website:
93
94	https://security.gentoo.org/glsa/201804-13
95
96	Concerns?
97	=========
98
99	Security is a primary focus of Gentoo Linux and ensuring the
100	confidentiality and security of our users' machines is of utmost
101	importance to us. Any security concerns should be addressed to
102	security@g.o or alternatively, you may file a bug at
103	https://bugs.gentoo.org.
104
105	License
106	=======
107
108	Copyright 2018 Gentoo Foundation, Inc; referenced text
109	belongs to its owner(s).
110
111	The contents of this document are licensed under the
112	Creative Commons - Attribution / Share Alike license.
113
114	https://creativecommons.org/licenses/by-sa/2.5