ncurses <6.4 Memory Corruption via Malformed terminfo (setuid)
CVE-2023-29491 Published on April 14, 2023
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Products Associated with CVE-2023-29491
stack.watch emails you whenever new vulnerabilities are published in GNU Ncurses or Canonical Ubuntu Linux. Just hit a watch button to start following.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.