CVE-2021-39537CWE-787

CVE-2021-39537

High · published September 20, 2021

CVSS v3.1
8.8
EPSS
3%
Percentile
88.1
In the wild
Unconfirmed
What it is

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03216 · 88.1th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2021-09-20T20:15Z
Affected products (4)
ProductVersionsFixed in
invisible-island/ncurses≤ 6.2.1—
apple/mac_os_xall versions—
apple/macosall versions—
apple/macosall versions—
References (24)
http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup · [email protected]http://seclists.org/fulldisclosure/2022/Oct/28 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/41 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/43 · [email protected]http://seclists.org/fulldisclosure/2022/Oct/45 · [email protected]https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html · [email protected]https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html · [email protected]https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html · [email protected]https://security.netapp.com/advisory/ntap-20230427-0012/ · [email protected]https://support.apple.com/kb/HT213443 · [email protected]https://support.apple.com/kb/HT213444 · [email protected]https://support.apple.com/kb/HT213488 · [email protected]http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/28 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/41 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/43 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2022/Oct/45 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html · af854a3a-2127-422b-91ae-364da2661108https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html · af854a3a-2127-422b-91ae-364da2661108https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230427-0012/ · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213443 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213444 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT213488 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 20 SEP 00:00Z
    An issue was discovered in ncurses through v6.2-1
    cvelistv5