Security update for ncurses SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0178-1 Final 1 1 2018-01-23T09:38:48Z current 2018-01-23T09:38:48Z 2018-01-23T09:38:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ncurses This update for ncurses fixes the following issues: Security issue fixed: - CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-ncurses-13430,slessp4-ncurses-13430 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180178-1/ Link for SUSE-SU-2018:0178-1 https://lists.suse.com/pipermail/sle-security-updates/2018-January/003620.html E-Mail link for SUSE-SU-2018:0178-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1056127 SUSE Bug 1056127 https://www.suse.com/security/cve/CVE-2017-13733/ SUSE CVE CVE-2017-13733 page SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Server for SAP Applications 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 ncurses-devel-5.6-93.15.1 ncurses-devel-32bit-5.6-93.15.1 tack-5.6-93.15.1 libncurses5-5.6-93.15.1 libncurses5-32bit-5.6-93.15.1 libncurses5-x86-5.6-93.15.1 libncurses6-5.6-93.15.1 libncurses6-32bit-5.6-93.15.1 libncurses6-x86-5.6-93.15.1 ncurses-utils-5.6-93.15.1 terminfo-5.6-93.15.1 terminfo-base-5.6-93.15.1 libncurses5-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses5-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses5-x86-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses6-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses6-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses6-x86-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 ncurses-devel-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 ncurses-devel-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 ncurses-utils-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 tack-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 terminfo-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 terminfo-base-5.6-93.15.1 as a component of SUSE Linux Enterprise Server 11 SP4 libncurses5-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libncurses5-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libncurses5-x86-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libncurses6-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libncurses6-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 libncurses6-x86-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ncurses-devel-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ncurses-devel-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ncurses-utils-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 tack-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 terminfo-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 terminfo-base-5.6-93.15.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP4 ncurses-devel-5.6-93.15.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 ncurses-devel-32bit-5.6-93.15.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 tack-5.6-93.15.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 There is an illegal address access in the fmt_entry function in progs/dump_entry.c in ncurses 6.0 that might lead to a remote denial of service attack. CVE-2017-13733 SUSE Linux Enterprise Server 11 SP4:libncurses5-32bit-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:libncurses5-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:libncurses5-x86-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:libncurses6-32bit-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:libncurses6-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:libncurses6-x86-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:ncurses-devel-32bit-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:ncurses-devel-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:ncurses-utils-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:tack-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:terminfo-5.6-93.15.1 SUSE Linux Enterprise Server 11 SP4:terminfo-base-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses5-32bit-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses5-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses5-x86-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses6-32bit-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses6-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:libncurses6-x86-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ncurses-devel-32bit-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ncurses-devel-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:ncurses-utils-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:tack-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:terminfo-5.6-93.15.1 SUSE Linux Enterprise Server for SAP Applications 11 SP4:terminfo-base-5.6-93.15.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ncurses-devel-32bit-5.6-93.15.1 SUSE Linux Enterprise Software Development Kit 11 SP4:ncurses-devel-5.6-93.15.1 SUSE Linux Enterprise Software Development Kit 11 SP4:tack-5.6-93.15.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180178-1/ https://www.suse.com/security/cve/CVE-2017-13733.html CVE-2017-13733 https://bugzilla.suse.com/1056127 SUSE Bug 1056127 https://bugzilla.suse.com/1069530 SUSE Bug 1069530 https://bugzilla.suse.com/1115932 SUSE Bug 1115932 https://bugzilla.suse.com/1123132 SUSE Bug 1123132 https://bugzilla.suse.com/1175501 SUSE Bug 1175501