Univention Bugzilla – Bug 56893
ncurses: Multiple issues (5.0)
Last modified: 2023-12-06 12:59:20 CET
New Debian ncurses 6.1+20181013-2+deb10u5 fixes: This update addresses the following issues: 6.1+20181013-2+deb10u5 (Sun, 03 Dec 2023 16:31:37 +0100) * Non-maintainer upload by the LTS Security Team. * Fix CVE-2021-39537: Heap-based buffer overflow in _nc_captoinfo(). * Mitigate CVE-2023-29491: Configure with `--disable-root-environ` (changed to match the behavior of the `--disable-setuid-environ` flag introduced in the 20230423 patchlevel) in order to disallow loading of custom terminfo entries in setuid/setgid programs. * d/libtinfo5.symbols, d/libtinfo6.symbols: Add new exported symbol _nc_env_access (exposed by the new configure flag).
--- mirror/ftp/pool/main/n/ncurses/ncurses_6.1+20181013-2+deb10u4.dsc +++ apt/ucs_5.0-0-errata5.0-5/source/ncurses_6.1+20181013-2+deb10u5.dsc @@ -1,3 +1,14 @@ +6.1+20181013-2+deb10u5 [Sun, 03 Dec 2023 16:31:37 +0100] Guilhem Moulin <guilhem@debian.org>: + + * Non-maintainer upload by the LTS Security Team. + * Fix CVE-2021-39537: Heap-based buffer overflow in _nc_captoinfo(). + * Mitigate CVE-2023-29491: Configure with `--disable-root-environ` (changed + to match the behavior of the `--disable-setuid-environ` flag introduced in + the 20230423 patchlevel) in order to disallow loading of custom terminfo + entries in setuid/setgid programs. (Closes: #1034372) + * d/libtinfo5.symbols, d/libtinfo6.symbols: Add new exported symbol + _nc_env_access (exposed by the new configure flag). + 6.1+20181013-2+deb10u4 [Thu, 28 Sep 2023 12:35:46 +0100] Sean Whitton <spwhitton@spwhitton.name>: [ Sean Whitton ] <http://piuparts.knut.univention.de/5.0-5/#2182347748592390173>
OK: bug OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-5] 56a4caf0a8 Bug #56893: ncurses 6.1+20181013-2+deb10u5 doc/errata/staging/ncurses.yaml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) [5.0-5] 2cfcc3bdb7 Bug #56893: ncurses 6.1+20181013-2+deb10u5 doc/errata/staging/ncurses.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x894>