CVE-2018-19217

Published: 12 November 2018

** DISPUTED ** In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party.

Notes

for xenial and trusty the issue reproduces for the release version of
the package with the provided POC file. However, patches applied to fix
the CVE group CVE-2017-137xx and the CVE group CVE-2017-1068x have most
likely fixed the currently considered vulnerability as well, with the
reproducer no longer causing a segmentation fault for versions of the
package that include these patches. This means that within the fixes
present in the already applied patches was the fix for this CVE as well.

Status

Severity score breakdown

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1643753
• https://lists.gnu.org/archive/html/bug-ncurses/2019-04/msg00020.html
• https://www.cve.org/CVERecord?id=CVE-2018-19217
• NVD
• Launchpad
• Debian