NVD Vulnerability Detail

CVE-2020-19190

Summary	Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.
Publication Date	Aug. 23, 2023, 4:16 a.m.
Registration Date	Aug. 23, 2023, 10:01 a.m.
Last Update	Nov. 21, 2024, 2:09 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:gnu:ncurses:6.1:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vsphere::

Related information, measures and tools

No	URL	タグ
1	http://seclists.org/fulldisclosure/2023/Dec/10
2	http://seclists.org/fulldisclosure/2023/Dec/10
3	http://seclists.org/fulldisclosure/2023/Dec/11
4	http://seclists.org/fulldisclosure/2023/Dec/11
5	http://seclists.org/fulldisclosure/2023/Dec/9
6	http://seclists.org/fulldisclosure/2023/Dec/9
7	https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md	Exploit Third Party Advisory
8	https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md	Exploit Third Party Advisory
9	https://security.netapp.com/advisory/ntap-20231006-0005/	Third Party Advisory
10	https://security.netapp.com/advisory/ntap-20231006-0005/	Third Party Advisory
11	https://support.apple.com/kb/HT214036
12	https://support.apple.com/kb/HT214036
13	https://support.apple.com/kb/HT214037
14	https://support.apple.com/kb/HT214037
15	https://support.apple.com/kb/HT214038
16	https://support.apple.com/kb/HT214038

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

GNU Project の ncurses 等複数ベンダの製品における境界外書き込みに関する脆弱性

Title	GNU Project の ncurses 等複数ベンダの製品における境界外書き込みに関する脆弱性
Summary	GNU Project の ncurses 等複数ベンダの製品には、境界外書き込みに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	参考情報を参照して適切な対策を実施してください。
Publication Date	Aug. 13, 2020, midnight
Registration Date	Jan. 23, 2024, 10:45 a.m.
Last Update	Jan. 23, 2024, 10:45 a.m.

Affected System

GNU Project

ncurses 6.1

NetApp

Active IQ Unified Manager

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-19190	https://www.cve.org/CVERecord?id=CVE-2020-19190
National Vulnerability Database (NVD)
2	CVE-2020-19190	https://nvd.nist.gov/vuln/detail/CVE-2020-19190

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-787	https://cwe.mitre.org/data/definitions/787.html

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-23-348-10	https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10
JVN
2	JVNVU#98271228	https://jvn.jp/vu/JVNVU98271228/
関連文書
3	github.com (infotocap_poc6.md)	https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md
4	seclists.org (Dec/10)	http://seclists.org/fulldisclosure/2023/Dec/10
5	seclists.org (Dec/11)	http://seclists.org/fulldisclosure/2023/Dec/11
6	seclists.org (Dec/9)	http://seclists.org/fulldisclosure/2023/Dec/9
7	security.netapp.com (ntap-20231006-0005)	https://security.netapp.com/advisory/ntap-20231006-0005/
8	support.apple.com (HT214036)	https://support.apple.com/kb/HT214036
9	support.apple.com (HT214037)	https://support.apple.com/kb/HT214037
10	support.apple.com (HT214038)	https://support.apple.com/kb/HT214038

Change Log

No	Changed Details	Date of change
1	[2024年01月23日] 掲載	Jan. 23, 2024, 10:45 a.m.