CVE-2021-39537

🟠 Łataj w tym tygodniu

Przepełnienie bufora w ncurses umożliwia zdalne wykonanie kodu.

CVSS

8.8

EPSS

3.2%

Exploit

poc

Vendor

apple

Opis źródłowy (NVD)

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

buffer-overflow exploit Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	8.8
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	3.2%
Opublikowano (NVD)	2021-09-20 16:15:12 UTC
Ostatnia modyfikacja (NVD)	2026-10-08 21:17:39 UTC

Referencje

http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup ([email protected]) [Patch, Third Party Advisory]
http://seclists.org/fulldisclosure/2022/Oct/28 ([email protected]) [Mailing List, Third Party Advisory]
http://seclists.org/fulldisclosure/2022/Oct/41 ([email protected]) [Mailing List, Third Party Advisory]
http://seclists.org/fulldisclosure/2022/Oct/43 ([email protected]) [Mailing List, Third Party Advisory]
http://seclists.org/fulldisclosure/2022/Oct/45 ([email protected]) [Mailing List, Third Party Advisory]
https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html ([email protected])
https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html ([email protected]) [Exploit, Mailing List, Vendor Advisory]
https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html ([email protected]) [Mailing List, Vendor Advisory]
https://security.netapp.com/advisory/ntap-20230427-0012/ ([email protected])
https://support.apple.com/kb/HT213443 ([email protected]) [Third Party Advisory]
https://support.apple.com/kb/HT213444 ([email protected]) [Third Party Advisory]
https://support.apple.com/kb/HT213488 ([email protected]) [Third Party Advisory]