A vulnerability was found in ncurses and occurs when used by a setuid application. (CVE-2023-29491)
22702
07 November 2023
07 November 2023
CLOSED
MEDIUM
7.8 HIGH - Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2023-29491
|
Brocade Security Advisory ID |
BSA-2023-2260 |
|
Component |
ncurses |
|
|
|
Summary
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Products Affected
- Brocade ASGC - Fixed in Brocade ASCG v3.0
Products Confirmed Not Affected
- Brocade Fabric OS is Not Affected
- Brocade SANnav is Not Affected
Solution
Brocade recommends that customers apply the patch.
Revision History
|
Version |
Change |
Date |
|
1.0 |
Initial Publication |
November 7, 2023 |
Disclaimer
THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.