Vulnerability · Published Aug 22, 2023 · Assigned by mitre
CVE-2020-19186
Medium 6.5
In plain English
A medium-severity security flaw in the ncurses package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.0%top 18.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ncurses | 6.1+20191019-1 | DEBIAN-CVE-2020-19186 |
| Debian:13 | ncurses | 6.1+20191019-1 | DEBIAN-CVE-2020-19186 |
| Debian:14 | ncurses | 6.1+20191019-1 | DEBIAN-CVE-2020-19186 |
| Ubuntu:22.04:LTS | ncurses | 6.3-2ubuntu0.1 | UBUNTU-CVE-2020-19186 |
Affected products (as reported)
References
- https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md
- https://security.netapp.com/advisory/ntap-20231006-0005/
- https://support.apple.com/kb/HT214038
- https://support.apple.com/kb/HT214036
- https://support.apple.com/kb/HT214037
- 20231212 APPLE-SA-12-11-2023-4 macOS Sonoma 14.2 mailing-list
- 20231212 APPLE-SA-12-11-2023-5 macOS Ventura 13.6.3 mailing-list
- 20231212 APPLE-SA-12-11-2023-6 macOS Monterey 12.7.2 mailing-list
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html