CVE-2023-29491
ncurses: Local users can trigger security-relevant memory corruption via malformed data
Severity Score
Exploit Likelihood
Affected Versions
1Public Exploits
1Exploited in Wild
-Decision
Descriptions
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
A vulnerability was found in ncurses and occurs when used by a setuid application. This flaw allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Multicluster Engine for Kubernetes 2.3.2 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-04-07 CVE Reserved
- 2023-04-14 CVE Published
- 2024-11-27 CVE Updated
- 2024-11-27 First Exploit
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-121: Stack-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (13)
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2023/04/19/11 | 2024-11-27 |
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2023/04/19/10 | 2024-01-31 | |
| https://www.openwall.com/lists/oss-security/2023/04/13/4 | 2024-01-31 |