According to the versions of the ncurses packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In ncurses 6.1, there is a NULL pointer dereference at     function _nc_parse_entry in parse_entry.c that will     lead to a denial of service attack. The product     proceeds to the dereference code path even after a     'dubious character `*' in name or alias field'     detection.(CVE-2018-19211)

  - There is a heap-based buffer over-read in the
    _nc_find_entry function in tinfo/comp_hash.c in the     terminfo library in ncurses before     6.1-20191012.(CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry     function in tinfo/comp_hash.c in the terminfo library     in ncurses before 6.1-20191012.(CVE-2019-17595)

  - There is an illegal address access in the
    _nc_safe_strcat function in strings.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13734)

  - There is an illegal address access in the _nc_save_str     function in alloc_entry.c in ncurses 6.0. It will lead     to a remote denial of service attack.(CVE-2017-13729)

  - There is an illegal address access in the fmt_entry     function in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13733)

  - There is an illegal address access in the function
    _nc_read_entry_source() in progs/tic.c in ncurses 6.0     that might lead to a remote denial of service     attack.(CVE-2017-13730)

  - There is an illegal address access in the function     dump_uses() in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13732)

  - There is an illegal address access in the function     postprocess_termcap() in parse_entry.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13731)

  - There is an infinite loop in the next_char function in     comp_scan.c in ncurses 6.0, related to libtic. A     crafted input will lead to a remote denial of service     attack.(CVE-2017-13728)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4426 advisory.

    The ncurses (new curses) library routines are a terminal-independent method of updating character screens     with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler     tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.

    Security Fix(es):

    * ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)

    * ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4426 advisory.

    - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has ncurses packages installed that are affected by multiple vulnerabilities:

  - There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the ncurses package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2021:4426 advisory.

  - ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)

  - ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ncurses-6.2-8.20210508.el9 build changelog.

  - There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202101-28 (ncurses: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ncurses. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ncurses fixes the following issues :

Security issues fixed :

  - CVE-2019-17594: Fixed a heap-based buffer over-read in     the _nc_find_entry function (bsc#1154036).

  - CVE-2019-17595: Fixed a heap-based buffer over-read in     the fmt_entry function (bsc#1154037).

Non-security issue fixed :

  - Removed screen.xterm from terminfo database     (bsc#1103320).

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the ncurses packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read in the fmt_entry     function in tinfo/comp_hash.c in the terminfo library     in ncurses before 6.1-20191012.(CVE-2019-17595)

  - There is a heap-based buffer over-read in the
    _nc_find_entry function in tinfo/comp_hash.c in the     terminfo library in ncurses before     6.1-20191012.(CVE-2019-17594)

  - There is an illegal address access in the
    _nc_safe_strcat function in strings.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13734)

  - There is an illegal address access in the fmt_entry     function in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13733)

  - There is an illegal address access in the function     dump_uses() in progs/dump_entry.c in ncurses 6.0 that     might lead to a remote denial of service     attack.(CVE-2017-13732)

  - There is an illegal address access in the function     postprocess_termcap() in parse_entry.c in ncurses 6.0     that will lead to a remote denial of service     attack.(CVE-2017-13731)

  - There is an illegal address access in the function
    _nc_read_entry_source() in progs/tic.c in ncurses 6.0     that might lead to a remote denial of service     attack.(CVE-2017-13730)

  - There is an illegal address access in the _nc_save_str     function in alloc_entry.c in ncurses 6.0. It will lead     to a remote denial of service attack.(CVE-2017-13729)

  - There is an infinite loop in the next_char function in     comp_scan.c in ncurses 6.0, related to libtic. A     crafted input will lead to a remote denial of service     attack.(CVE-2017-13728)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ncurses packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is a heap-based buffer over-read in the fmt_entry     function in tinfo/comp_hash.c in the terminfo library     in ncurses before 6.1-20191012.(CVE-2019-17595)

  - There is a heap-based buffer over-read in the
    _nc_find_entry function in tinfo/comp_hash.c in the     terminfo library in ncurses before     6.1-20191012.(CVE-2019-17594)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4426 advisory.

  - There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

  - There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ncurses installed on the remote host is prior to 6.0-8.20170212. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2412 advisory.

    There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17594)

    There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo     library in ncurses before 6.1-20191012. (CVE-2019-17595)

    Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows     remote attackers to cause a denial of service via crafted command. (CVE-2020-19185)

    Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows     remote attackers to cause a denial of service via crafted command. (CVE-2020-19186)

    Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows     remote attackers to cause a denial of service via crafted command. (CVE-2020-19187)

    Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows     remote attackers to cause a denial of service via crafted command. (CVE-2020-19188)

    Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1     allows remote attackers to cause a denial of service via crafted command. (CVE-2020-19189)

    Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote     attackers to cause a denial of service via crafted command. (CVE-2020-19190)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
132169	EulerOS 2.0 SP3 : ncurses (EulerOS-SA-2019-2634)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	medium
155184	RHEL 8 : ncurses (RHSA-2021:4426)	Nessus	Red Hat Local Security Checks	2021/11/11	2024/11/7	medium
155409	Oracle Linux 8 : ncurses (ELSA-2021-4426)	Nessus	Oracle Linux Local Security Checks	2021/11/17	2024/11/1	medium
206858	NewStart CGSL MAIN 6.02 : ncurses Multiple Vulnerabilities (NS-SA-2024-0057)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	medium
202859	Photon OS 2.0: Ncurses PHSA-2019-2.0-0190	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/22	medium
155038	CentOS 8 : ncurses (CESA-2021:4426)	Nessus	CentOS Local Security Checks	2021/11/11	2023/11/24	medium
191233	CentOS 9 : ncurses-6.2-8.20210508.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
222783	Linux Distros Unpatched Vulnerability : CVE-2019-17595	Nessus	Misc.	2025/3/4	2025/3/4	medium
145433	GLSA-202101-28 : ncurses: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2021/1/26	2024/1/26	medium
131278	openSUSE Security Update : ncurses (openSUSE-2019-2550)	Nessus	SuSE Local Security Checks	2019/11/25	2024/4/10	medium
137951	EulerOS Virtualization 3.0.6.0 : ncurses (EulerOS-SA-2020-1732)	Nessus	Huawei Local Security Checks	2020/7/1	2024/3/5	medium
134207	Photon OS 1.0: Ncurses PHSA-2020-1.0-0281	Nessus	PhotonOS Local Security Checks	2020/3/2	2024/3/25	medium
134495	EulerOS Virtualization for ARM 64 3.0.2.0 : ncurses (EulerOS-SA-2020-1206)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	medium
184850	Rocky Linux 8 : ncurses (RLSA-2021:4426)	Nessus	Rocky Linux Local Security Checks	2023/11/7	2023/11/7	medium
187824	Amazon Linux 2 : ncurses (ALAS-2024-2412)	Nessus	Amazon Linux Local Security Checks	2024/1/9	2024/12/11	critical

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical