Bug 624644 (CVE-2017-11112, CVE-2017-11113) – <sys-libs/ncurses-6.1: two remote DoS (CVE-2017-11112)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2017-07-12 07:17:34 UTC]

CVE-2017-11112 (https://nvd.nist.gov/vuln/detail/CVE-2017-11112):

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.


CVE-2017-11113 (https://nvd.nist.gov/vuln/detail/CVE-2017-11113):

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Aleksandr Wagner (Kivak) 2017-08-29 12:31:34 UTC]

The patches are available.

CVE-2017-11112 patch:

https://bugzilla.redhat.com/show_bug.cgi?id=1473306
https://lists.gnu.org/archive/html/bug-ncurses/2017-07/msg00001.html

CVE-2017-11113 patch:

https://bugzilla.redhat.com/show_bug.cgi?id=1473310
https://lists.gnu.org/archive/html/bug-ncurses/2017-07/msg00001.html

[Comment 2 GLSAMaker/CVETool Bot 2018-04-17 18:19:49 UTC]

This issue was resolved and addressed in
 GLSA 201804-13 at https://security.gentoo.org/glsa/201804-13
by GLSA coordinator Aaron Bauman (b-man).