[USN-6684-1] ncurses vulnerability

[Paulo Flabiano Smorigo]

==========================================================================
Ubuntu Security Notice USN-6684-1
March 07, 2024

ncurses vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

ncurses could be made to crash if it received specially crafted
input.

Software Description:
- ncurses: shared libraries for terminal handling

Details:

It was discovered that ncurses incorrectly handled certain function return
values, possibly leading to segmentation fault. A local attacker could possibly
use this to cause a denial of service (system crash).

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   6.1-1ubuntu1.18.04.1+esm2
  lib32tinfo5                     6.1-1ubuntu1.18.04.1+esm2
  lib64ncurses5                   6.1-1ubuntu1.18.04.1+esm2
  lib64tinfo5                     6.1-1ubuntu1.18.04.1+esm2
  libncurses5                     6.1-1ubuntu1.18.04.1+esm2
  libtinfo5                       6.1-1ubuntu1.18.04.1+esm2
  libx32ncurses5                  6.1-1ubuntu1.18.04.1+esm2
  libx32tinfo5                    6.1-1ubuntu1.18.04.1+esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   6.0+20160213-1ubuntu1+esm5
  lib32tinfo5                     6.0+20160213-1ubuntu1+esm5
  lib64ncurses5                   6.0+20160213-1ubuntu1+esm5
  lib64tinfo5                     6.0+20160213-1ubuntu1+esm5
  libncurses5                     6.0+20160213-1ubuntu1+esm5
  libtinfo5                       6.0+20160213-1ubuntu1+esm5
  libx32ncurses5                  6.0+20160213-1ubuntu1+esm5
  libx32tinfo5                    6.0+20160213-1ubuntu1+esm5

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   5.9+20140118-1ubuntu1+esm5
  lib32tinfo5                     5.9+20140118-1ubuntu1+esm5
  lib64ncurses5                   5.9+20140118-1ubuntu1+esm5
  lib64tinfo5                     5.9+20140118-1ubuntu1+esm5
  libncurses5                     5.9+20140118-1ubuntu1+esm5
  libtinfo5                       5.9+20140118-1ubuntu1+esm5
  libx32ncurses5                  5.9+20140118-1ubuntu1+esm5
  libx32tinfo5                    5.9+20140118-1ubuntu1+esm5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6684-1
  CVE-2023-50495
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240307/b8fc0a48/attachment.sig>