Ubuntu alert USN-6684-1 (ncurses)

From:
             
 
Paulo Flabiano Smorigo <pfsmorigo@canonical.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-6684-1] ncurses vulnerability
Date:
             
 
Thu, 07 Mar 2024 20:38:50 -0300
Message-ID:
             
 
<20240307233850.idquximx6y52gfz7@morty>
==========================================================================
Ubuntu Security Notice USN-6684-1
March 07, 2024

ncurses vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

ncurses could be made to crash if it received specially crafted
input.

Software Description:
- ncurses: shared libraries for terminal handling

Details:

It was discovered that ncurses incorrectly handled certain function return
values, possibly leading to segmentation fault. A local attacker could possibly
use this to cause a denial of service (system crash).

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   6.1-1ubuntu1.18.04.1+esm2
  lib32tinfo5                     6.1-1ubuntu1.18.04.1+esm2
  lib64ncurses5                   6.1-1ubuntu1.18.04.1+esm2
  lib64tinfo5                     6.1-1ubuntu1.18.04.1+esm2
  libncurses5                     6.1-1ubuntu1.18.04.1+esm2
  libtinfo5                       6.1-1ubuntu1.18.04.1+esm2
  libx32ncurses5                  6.1-1ubuntu1.18.04.1+esm2
  libx32tinfo5                    6.1-1ubuntu1.18.04.1+esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   6.0+20160213-1ubuntu1+esm5
  lib32tinfo5                     6.0+20160213-1ubuntu1+esm5
  lib64ncurses5                   6.0+20160213-1ubuntu1+esm5
  lib64tinfo5                     6.0+20160213-1ubuntu1+esm5
  libncurses5                     6.0+20160213-1ubuntu1+esm5
  libtinfo5                       6.0+20160213-1ubuntu1+esm5
  libx32ncurses5                  6.0+20160213-1ubuntu1+esm5
  libx32tinfo5                    6.0+20160213-1ubuntu1+esm5

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  lib32ncurses5                   5.9+20140118-1ubuntu1+esm5
  lib32tinfo5                     5.9+20140118-1ubuntu1+esm5
  lib64ncurses5                   5.9+20140118-1ubuntu1+esm5
  lib64tinfo5                     5.9+20140118-1ubuntu1+esm5
  libncurses5                     5.9+20140118-1ubuntu1+esm5
  libtinfo5                       5.9+20140118-1ubuntu1+esm5
  libx32ncurses5                  5.9+20140118-1ubuntu1+esm5
  libx32tinfo5                    5.9+20140118-1ubuntu1+esm5

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6684-1
  CVE-2023-50495