- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202408-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: ncurses: Multiple Vulnerabilities
Date: August 09, 2024
Bugs: #839351, #904247
ID: 202408-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in ncurses, the worst of
which could lead to a denial of service.

Background
==========

Free software emulation of curses in System V.

Affected packages
=================

Package Vulnerable Unaffected
----------------------- --------------- ----------------
sys-libs/ncurses < 6.4_p20230408 >= 6.4_p20230408 sys-libs/ncurses-compat < 6.4_p20240330 >= 6.4_p20240330

Description
===========

Multiple vulnerabilities have been discovered in ncurses. Please review
the CVE identifiers referenced below for details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All ncurses users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.4_p20230408"
# emerge --ask --oneshot --verbose ">=sys-libs/ncurses-compat-6.4_p20240330"

References
==========

[ 1 ] CVE-2022-29458
https://nvd.nist.gov/vuln/detail/CVE-2022-29458
[ 2 ] CVE-2023-29491
https://nvd.nist.gov/vuln/detail/CVE-2023-29491

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202408-19

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAma1+BEACgkQFMQkOaVy +9k1JhAAyctrnKGlzbU97ch0A3ZtJYE6YKzebaljZ8/LGGyEZmUBvvyzIviS0XrD MtOWGGoIlbpfKcrseWsZWZIZ1sEf4Y0HQvLKwenFGeiaWAuAE+pznAgXRbszT0DY HXDoEknXAIUo2oXxUAXg44godRGyoOV8rrkduBymHZMdkC5M8R9hcFLnZ4iN4J+O mj0Tck0kPjbh6QXHIrUET0Es/cHwYJDurGXX/VWRpSOu5sL3IIcey1D72KJ0PHoY hteq2JeQEdz6BlPEN9uPYNT31fOflpFzBK43R1faIOBVPvVePUJNIfptklHgrHXb N2tIYfBPMDJ4my3wrRlOS7RzysPUbbcLLbmU12IzNc5XYZhvf3A49/4SRGq0262c QYUgKc1iCwSdxjJy4QKcVwsO86bhXGQcirzvDyJrXJl+hCGjf7kdOl8Lu34y3mBP 8490/KOrXh218NeOpYR1OSlKhij6bJRX633XURBerhJtQxAK+T6FWJmhO2LOUO+j WhApBAhf46DuhXJezdg/D/7SqhPVD2pQCGF9Wqtb/2yJdx15IGmlATEGnuvtm6I3 cHVssqhF2u3+6GGM9WgVeIHdONs1a2DFVNK7tyzSuIE7+piG3zVjBxzu41UG+f8i s5E5AHUEc9LSRqv5a/pT302V4IzIIXtbf+ld39f7QAzoF+0A7w8=
=CRle
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)