CVE-2019-17595

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2019-10-14

Last modified

2026-10-14

Weaknesses

CWE-125

Affected products

• Ncurses (Invisible-island)
• Leap (Opensuse)
• Simatic S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
• Simatic S7-1500 Cpu 1518f-4 Pndp Mfp (Siemens)
• Siplus S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)

References

• https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html
• https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html
• https://security.gentoo.org/glsa/202101-28
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html