CVE-2017-13734: invisible-island ncurses

Vulnerability summary

CVE-2017-13734 is a medium (CVSS 6.5) vulnerability in invisible-island ncurses. EPSS estimates a 2.15% chance of exploitation in the next 30 days, higher than 82.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-08-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

There is an illegal address access in the _nc_safe_strcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.