Invisible Island vulnerabilities
37 vulnerabilities
Known vulnerabilities in Invisible Island products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.
Products
5PrioritiseCVE-2017-20229mawk +3 moreMAWK 1.3.3-17 Stack-Based Buffer OverflowMAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers can craft malicious input that overflows the stack buffer and execute a return-oriented programming chain to spawn a shell with application privileges.CVSS9.8CriticalEPSS0.61%PrioritiseCVE-2025-69720gnu · ncurses +29 moregnu ncursesThe infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.CVSS7.8HighEPSS0.46%RoutineCVE-2023-50495invisible-island · ncurse +20 moreinvisible-island ncurseNCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().CVSS6.5MediumEPSS1.04%RoutineCVE-2020-19190invisible-island · ncurses +3 moreinvisible-island ncursesBuffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS1.94%RoutineCVE-2020-19189debian · debian_linux +4 moredebian debian_linuxBuffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS2.29%RoutineCVE-2020-19188invisible-island · ncurses +3 moreinvisible-island ncursesBuffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS1.94%RoutineCVE-2020-19187invisible-island · ncurses +3 moreinvisible-island ncursesBuffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS1.94%RoutineCVE-2020-19186invisible-island · ncurses +3 moreinvisible-island ncursesBuffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS2.04%RoutineCVE-2020-19185invisible-island · ncurses +3 moreinvisible-island ncursesBuffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.CVSS6.5MediumEPSS1.94%PrioritiseCVE-2023-40359invisible-island · xterm +9 moreinvisible-island xtermxterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.CVSS9.8CriticalEPSS0.85%PrioritiseCVE-2023-29491invisible-island · ncurses +29 moreinvisible-island ncursesncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.CVSS7.8HighEPSS0.98%PrioritiseCVE-2022-45063fedoraproject · fedora +37 morefedoraproject fedoraxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.CVSS9.8CriticalEPSS5.45%PrioritiseCVE-2022-29458apple · macos +32 moreapple macosncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.CVSS7.1HighEPSS1.33%RoutineCVE-2022-24130debian · debian_linux +18 moredebian debian_linuxxterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.CVSS5.5MediumEPSS1.68%PrioritiseCVE-2021-39537apple · mac_os_x +18 moreapple mac_os_xAn issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.CVSS8.8HighEPSS3.24%PrioritiseCVE-2021-27135debian · debian_linux +44 moredebian debian_linuxxterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.CVSS9.8CriticalEPSS7.84%RoutineCVE-2019-17594invisible-island · ncurses +3 moreinvisible-island ncursesThere is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.CVSS5.3MediumEPSS0.55%RoutineCVE-2019-17595invisible-island · ncurses +3 moreinvisible-island ncursesThere is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.CVSS5.8MediumEPSS2.22%RoutineCVE-2018-19217invisible-island · ncurses +2 moreinvisible-island ncursesIn ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-partyCVSS6.5MediumEPSS1.16%RoutineCVE-2018-19211invisible-island · ncurses +13 moreinvisible-island ncursesIn ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.CVSS5.5MediumEPSS0.86%