Security update for ncurses SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:3490-1 Final 1 1 2021-10-20T14:32:21Z current 2021-10-20T14:32:21Z 2021-10-20T14:32:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ncurses This update for ncurses fixes the following issues: - CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-SLE-15.3-2021-3490 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2IZOG455BIMQ6NKBIPOWITV4SHIG5YT7/ E-Mail link for openSUSE-SU-2021:3490-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190793 SUSE Bug 1190793 https://www.suse.com/security/cve/CVE-2021-39537/ SUSE CVE CVE-2021-39537 page openSUSE Leap 15.3 libncurses5-6.1-5.9.1 libncurses5-32bit-6.1-5.9.1 libncurses6-6.1-5.9.1 libncurses6-32bit-6.1-5.9.1 ncurses-devel-6.1-5.9.1 ncurses-devel-32bit-6.1-5.9.1 ncurses-utils-6.1-5.9.1 ncurses5-devel-6.1-5.9.1 ncurses5-devel-32bit-6.1-5.9.1 tack-6.1-5.9.1 terminfo-6.1-5.9.1 terminfo-base-6.1-5.9.1 terminfo-iterm-6.1-5.9.1 terminfo-screen-6.1-5.9.1 libncurses5-6.1-5.9.1 as a component of openSUSE Leap 15.3 libncurses5-32bit-6.1-5.9.1 as a component of openSUSE Leap 15.3 libncurses6-6.1-5.9.1 as a component of openSUSE Leap 15.3 libncurses6-32bit-6.1-5.9.1 as a component of openSUSE Leap 15.3 ncurses-devel-6.1-5.9.1 as a component of openSUSE Leap 15.3 ncurses-devel-32bit-6.1-5.9.1 as a component of openSUSE Leap 15.3 ncurses-utils-6.1-5.9.1 as a component of openSUSE Leap 15.3 ncurses5-devel-6.1-5.9.1 as a component of openSUSE Leap 15.3 ncurses5-devel-32bit-6.1-5.9.1 as a component of openSUSE Leap 15.3 tack-6.1-5.9.1 as a component of openSUSE Leap 15.3 terminfo-6.1-5.9.1 as a component of openSUSE Leap 15.3 terminfo-base-6.1-5.9.1 as a component of openSUSE Leap 15.3 terminfo-iterm-6.1-5.9.1 as a component of openSUSE Leap 15.3 terminfo-screen-6.1-5.9.1 as a component of openSUSE Leap 15.3 An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow. CVE-2021-39537 openSUSE Leap 15.3:libncurses5-32bit-6.1-5.9.1 openSUSE Leap 15.3:libncurses5-6.1-5.9.1 openSUSE Leap 15.3:libncurses6-32bit-6.1-5.9.1 openSUSE Leap 15.3:libncurses6-6.1-5.9.1 openSUSE Leap 15.3:ncurses-devel-32bit-6.1-5.9.1 openSUSE Leap 15.3:ncurses-devel-6.1-5.9.1 openSUSE Leap 15.3:ncurses-utils-6.1-5.9.1 openSUSE Leap 15.3:ncurses5-devel-32bit-6.1-5.9.1 openSUSE Leap 15.3:ncurses5-devel-6.1-5.9.1 openSUSE Leap 15.3:tack-6.1-5.9.1 openSUSE Leap 15.3:terminfo-6.1-5.9.1 openSUSE Leap 15.3:terminfo-base-6.1-5.9.1 openSUSE Leap 15.3:terminfo-iterm-6.1-5.9.1 openSUSE Leap 15.3:terminfo-screen-6.1-5.9.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2IZOG455BIMQ6NKBIPOWITV4SHIG5YT7/ https://www.suse.com/security/cve/CVE-2021-39537.html CVE-2021-39537 https://bugzilla.suse.com/1190793 SUSE Bug 1190793 https://bugzilla.suse.com/1196626 SUSE Bug 1196626