SUSE-SU-2019:2997-1

MEDIUM4.0

Security update for ncurses

Published Nov 18, 2019

Modified 6 years ago

Fix available

Details

Description of the patch:

This update for ncurses fixes the following issues:

Security issues fixed:

CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).
CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).

Non-security issue fixed:

Removed screen.xterm from terminfo database (bsc#1103320).

Affected Packages(13 packages)

libncurses6

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

libncurses6-32bit

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

ncurses-devel

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

ncurses-utils

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

tack

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

terminfo

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

terminfo-base

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

terminfo-iterm

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

terminfo-screen

SUSE Linux Enterprise Module for Basesystem 15SUSE Linux Enterprise Module for Basesystem 15 SP1

Fixed in:

6.1-5.6.2

ncurses-devel-32bit

SUSE Linux Enterprise Module for Development Tools 15SUSE Linux Enterprise Module for Development Tools 15 SP1

Fixed in:

6.1-5.6.2

References

https://bugzilla.suse.com/1103320

https://bugzilla.suse.com/1154036

https://bugzilla.suse.com/1154037

https://lists.suse.com/pipermail/sle-security-updates/2019-November/006155.html

https://www.suse.com/security/cve/CVE-2019-17594/

https://www.suse.com/security/cve/CVE-2019-17595/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2019/suse-su-20192997-1/

CVSS Analysis

CVSS v3.0

4.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

LowA:L

4.0/CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Upstream

CVE-2019-17594 CVE-2019-17595

Ecosystems(6)

SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Development Tools 15 SUSE Linux Enterprise Module for Development Tools 15 SP1 SUSE Linux Enterprise Module for Legacy 15

Timeline

PublishedNov 18, 2019

ModifiedNov 18, 2019

SUSE-SU-2019:2997-1 | Mondoo Vulnerability Intelligence