CVE-2021-39537: An issue was discovered in ncurses through v6.2-1

High severity · published Sep 20, 2021

CVE-2021-39537

An issue was discovered in ncurses through v6.2-1

8.8

CVSS

3.2%

EPSS

On KEV

Description

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.2% · higher than 88% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

macOS · Apple

11.7; 13.0 · source: NVD

Mac OS X · Apple

10.12.6 · source: NVD

Ncurses · Invisible-island

through 6.2.1 · source: NVD

Affected product

macOS

Apple

All macOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-39537

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-39537

Patch

http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup

Mailing List

http://seclists.org/fulldisclosure/2022/Oct/28

Mailing List

http://seclists.org/fulldisclosure/2022/Oct/41

Mailing List

http://seclists.org/fulldisclosure/2022/Oct/43

Mailing List

http://seclists.org/fulldisclosure/2022/Oct/45

lists.debian.org

https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html