IM
IronMonkey Threat Research

CVE-2019-17595 MEDIUM

Published: 2019-10-14 | Last Modified: 2026-07-27 | Status: Modified

Description

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Additional Descriptions (1)

Hay una sobrelectura de búfer basada en memoria dinámica (heap) en la función fmt_entry en tinfo/comp_hash.c en la biblioteca terminfo en ncurses en versiones anteriores a la 6.1-20191012.

CVSS Metrics

Base Score: 5.4 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactNONE
Availability ImpactLOW

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 2.5

Base Score: 5.8 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:N/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 4.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-125

Affected Products

Vendor Product Version Update Type
invisible-island ncurses * <built-in method update of dict object at 0x7fd3854beec0> Application
opensuse leap 15.0 <built-in method update of dict object at 0x7fd3854bd840> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x7fd340be5b80> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:invisible-island:ncurses:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

References