Issued:
2021-11-09
Updated:
2021-11-09

RHSA-2021:4426 - Security Advisory

Synopsis

Moderate: ncurses security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for ncurses is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.

Security Fix(es):

  • ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)
  • ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1766617 - CVE-2019-17595 ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c
  • BZ - 1766745 - CVE-2019-17594 ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c

Red Hat Enterprise Linux for x86_64 8

SRPM
ncurses-6.1-9.20180224.el8.src.rpm SHA-256: 02e33c831c8096977393650a8d7460e1bda15582ea849daa591f582d0d125232
x86_64
ncurses-6.1-9.20180224.el8.x86_64.rpm SHA-256: 6d7a41fb238610416349a53d024cc505ab7f3f6e9953cc2244abb663ec404dad
ncurses-base-6.1-9.20180224.el8.noarch.rpm SHA-256: 78b6dd926d2a1dadb07ca4513e017796a485f3ef64466d06037d4db07f797f10
ncurses-c++-libs-6.1-9.20180224.el8.i686.rpm SHA-256: d9f81983a501858acf766cb15adc8b48f74a35e7d0c754b27975069cd7088a09
ncurses-c++-libs-6.1-9.20180224.el8.x86_64.rpm SHA-256: ef73e4ca60a20335709927305fc4c019bc42c54ffd6067bf9e484377ef6610b6
ncurses-c++-libs-debuginfo-6.1-9.20180224.el8.i686.rpm SHA-256: 2455d532629660f93ae8a49409903292cfe54d781b0320395dd8017ddff69163
ncurses-c++-libs-debuginfo-6.1-9.20180224.el8.x86_64.rpm SHA-256: af47405e35fcc55d6d6fc9869cdaea3850725c0fad824269a6e65dfcdc321453
ncurses-compat-libs-6.1-9.20180224.el8.i686.rpm SHA-256: 6f7bb873675cf4b07b2e1b9d48f2513380ef2b75364ce09a57013f8ba65c8a58
ncurses-compat-libs-6.1-9.20180224.el8.x86_64.rpm SHA-256: 0ebdfa0819c6883717ab037b4b4bb3831f240c86aa477117b7e5b1b5324fb105
ncurses-compat-libs-debuginfo-6.1-9.20180224.el8.i686.rpm SHA-256: c180707d4f492bde1f056d148f510eb007f36bf36d0df636d9635ec1df512528
ncurses-compat-libs-debuginfo-6.1-9.20180224.el8.x86_64.rpm SHA-256: 0934a94d542671b07bc541df70d25ecd92015dabbc12a8bb02baa38cd775d0d1
ncurses-debuginfo-6.1-9.20180224.el8.i686.rpm SHA-256: 3df448c6ce5d4d49dd30ec999accfd3e847a65718442401b3de61fc2567fe53e
ncurses-debuginfo-6.1-9.20180224.el8.x86_64.rpm SHA-256: 9d1cf53a02e819649783cca50989d3629dfd2067815540313c46cc7dc4af1fc2
ncurses-debugsource-6.1-9.20180224.el8.i686.rpm SHA-256: c5c215329f47a60a63722ff54bcbd2389ed39630399e489749595e5700aa5501
ncurses-debugsource-6.1-9.20180224.el8.x86_64.rpm SHA-256: 806a94e3a9f333762c68b8094482a41e76289d6ceaf94072fd0139ef0a4916c1
ncurses-devel-6.1-9.20180224.el8.i686.rpm SHA-256: 6962f9c826e6522ea5fe7c43351ceed014d24f4aa3b1dc537d8966642ee383fc
ncurses-devel-6.1-9.20180224.el8.x86_64.rpm SHA-256: dde5ec5a3057653b39513803f8e15ee66736751f566ff7482f940888b4429afa
ncurses-libs-6.1-9.20180224.el8.i686.rpm SHA-256: 502b7087b6792b15237cef52da0314a17ecf5257e960a2a883e00618fd3f78a2
ncurses-libs-6.1-9.20180224.el8.x86_64.rpm SHA-256: 62cea902bbf8da5f9ff08b186401f98b8d49779c74e7d93e511d3534f4c7fff0
ncurses-libs-debuginfo-6.1-9.20180224.el8.i686.rpm SHA-256: ab050f135f2b4e02c6973bc5c09ce8efa716decac51e338e239f346d67f76a9f
ncurses-libs-debuginfo-6.1-9.20180224.el8.x86_64.rpm SHA-256: a41ce369c91c8da64524b36ac730a54f22739fd29301e07d1a7a88b943dc01ce
ncurses-term-6.1-9.20180224.el8.noarch.rpm SHA-256: 3327899aadbd101fc7236a5f1a2d7b26284b50645d07797393df3bcb91645802

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
ncurses-6.1-9.20180224.el8.src.rpm SHA-256: 02e33c831c8096977393650a8d7460e1bda15582ea849daa591f582d0d125232
s390x
ncurses-6.1-9.20180224.el8.s390x.rpm SHA-256: 2107b58c7e5782ecf72f2d3b561197037ecd45c3a38f55f75b69711bca3005fc
ncurses-base-6.1-9.20180224.el8.noarch.rpm SHA-256: 78b6dd926d2a1dadb07ca4513e017796a485f3ef64466d06037d4db07f797f10
ncurses-c++-libs-6.1-9.20180224.el8.s390x.rpm SHA-256: 9f784600bb36d1c202b7a4c9266def9e3fdad84aebf74ed594d3d5ab9cc44a61
ncurses-c++-libs-debuginfo-6.1-9.20180224.el8.s390x.rpm SHA-256: 69d29426d344e9a8d3d55262cb21dbf2dc2c3c0035e06017a1d69bb0149af4e8
ncurses-compat-libs-6.1-9.20180224.el8.s390x.rpm SHA-256: daf457a628ced5aa9fd2982d47783d15f68aebe503f775f6c07644b4a5e16505
ncurses-compat-libs-debuginfo-6.1-9.20180224.el8.s390x.rpm SHA-256: dc0d8674e315e1290a03d601119517fd308ececfe14c6494bdabdf090b0675d2
ncurses-debuginfo-6.1-9.20180224.el8.s390x.rpm SHA-256: a03dac754d1b7a5eaab466849d5504f9e8f520b4db13d4686a3c998adde3ab09
ncurses-debugsource-6.1-9.20180224.el8.s390x.rpm SHA-256: f790d46b94f805d41723255a341a25c10ccbcf3bab535e1cd236c9a318ff7b76
ncurses-devel-6.1-9.20180224.el8.s390x.rpm SHA-256: 473564d06af364e1797f03aaf58aa43a90fec40abeca75d0366ce83a56152fe4
ncurses-libs-6.1-9.20180224.el8.s390x.rpm SHA-256: 8c399d0969bcdb0e833ca0a2bf5d310c47b80f190663598a40a047889ca12dd7
ncurses-libs-debuginfo-6.1-9.20180224.el8.s390x.rpm SHA-256: 3a5a99f606e095941e79d0ca61972a1245052d3527b58b890dc8fbdd3258f0f8
ncurses-term-6.1-9.20180224.el8.noarch.rpm SHA-256: 3327899aadbd101fc7236a5f1a2d7b26284b50645d07797393df3bcb91645802

Red Hat Enterprise Linux for Power, little endian 8

SRPM
ncurses-6.1-9.20180224.el8.src.rpm SHA-256: 02e33c831c8096977393650a8d7460e1bda15582ea849daa591f582d0d125232
ppc64le
ncurses-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 3f163501ded372ea7e61d1f918ccddf3144f669038053c32eb59acf8bc29d0b2
ncurses-base-6.1-9.20180224.el8.noarch.rpm SHA-256: 78b6dd926d2a1dadb07ca4513e017796a485f3ef64466d06037d4db07f797f10
ncurses-c++-libs-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 699ac44938aa96f059281bba14bfa757a82522708ebafd2ef823c34e95513ac9
ncurses-c++-libs-debuginfo-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 6e490617128c83e818228ae9ced8635b312d4a82f3081ae6da3eda3ed6543a5c
ncurses-compat-libs-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 2d84eaec3ac0fc5be3ca8ffec98c1e19d337668b24daa171846ab9fa8197fc01
ncurses-compat-libs-debuginfo-6.1-9.20180224.el8.ppc64le.rpm SHA-256: a244a73c799699ad56fa0e4c2eaf8ff66f3753995f9f9c27355173979bc79487
ncurses-debuginfo-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 09d1d343439c3c9e7d87e1d6f8434f3f496fda5e126e434f5c1655d377704d1a
ncurses-debugsource-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 8bd3d7b8a1eeceb1507a495782fece2621a2dca0b01da85154bbcdb25261e7cc
ncurses-devel-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 759cc3c27ffd527f82c1007878cedf4f10e1f1639c583ebada4124a28309a84e
ncurses-libs-6.1-9.20180224.el8.ppc64le.rpm SHA-256: ce4c3c1a7b545ba47da5993965acb341461487edd2f3f0f2eba662e85ac4ff24
ncurses-libs-debuginfo-6.1-9.20180224.el8.ppc64le.rpm SHA-256: 6b0f97b9d2fc41a59b58239aa82f0a00c1df425c22a06186626bd6c44131005b
ncurses-term-6.1-9.20180224.el8.noarch.rpm SHA-256: 3327899aadbd101fc7236a5f1a2d7b26284b50645d07797393df3bcb91645802

Red Hat Enterprise Linux for ARM 64 8

SRPM
ncurses-6.1-9.20180224.el8.src.rpm SHA-256: 02e33c831c8096977393650a8d7460e1bda15582ea849daa591f582d0d125232
aarch64
ncurses-6.1-9.20180224.el8.aarch64.rpm SHA-256: 5576dd75ef59f14f6f609c165406e1309120235977331dd521d452dbf962b10f
ncurses-base-6.1-9.20180224.el8.noarch.rpm SHA-256: 78b6dd926d2a1dadb07ca4513e017796a485f3ef64466d06037d4db07f797f10
ncurses-c++-libs-6.1-9.20180224.el8.aarch64.rpm SHA-256: 8f7ce8c162b33d6197cb65daf3a327ed7f9f651881676ebd9dd4714d7bf41af5
ncurses-c++-libs-debuginfo-6.1-9.20180224.el8.aarch64.rpm SHA-256: e68832881195b4feab019049a4c8c131c6b62ecde0f9d423a1732a82d5ef1f33
ncurses-compat-libs-6.1-9.20180224.el8.aarch64.rpm SHA-256: 1d5f355412fd9338d1e3e1221de0dff01360453703138f5bb0e84714145a2ef4
ncurses-compat-libs-debuginfo-6.1-9.20180224.el8.aarch64.rpm SHA-256: 26e72c8b0bccc4615d31166c099dd36b973392a215a8c44c4a816ad7220bee96
ncurses-debuginfo-6.1-9.20180224.el8.aarch64.rpm SHA-256: d1a41828fa62f4cbc7323e321c9ed33e344e9411d886ba563be99c4c6543bdf5
ncurses-debugsource-6.1-9.20180224.el8.aarch64.rpm SHA-256: 98077801f9809cbfda19abaabaaa5555a1382ae1f7065d04318981874f48778c
ncurses-devel-6.1-9.20180224.el8.aarch64.rpm SHA-256: d734457ae800bd47b21ed91aecc2cdabfdf9b259eb8c55a4bf2c46a328ae237a
ncurses-libs-6.1-9.20180224.el8.aarch64.rpm SHA-256: cf6fab023947931fd93103c1c273507294698dfe89051598d5548368cf63f3f6
ncurses-libs-debuginfo-6.1-9.20180224.el8.aarch64.rpm SHA-256: 3ce67ff8e65024d78407cf219f506214bf4e60f10a8bbc9829001014066bfad5
ncurses-term-6.1-9.20180224.el8.noarch.rpm SHA-256: 3327899aadbd101fc7236a5f1a2d7b26284b50645d07797393df3bcb91645802

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.