oss-sec mailing list archives
Re: ncurses fixes upstream
From: Carlos López <clopez () suse de>
Date: Wed, 19 Apr 2023 17:11:28 +0200
Hi, On 12/4/23 22:40, Jonathan Bar Or (JBO) wrote:
Hello oss-security, Our team has worked with the maintainer of the ncurses library (used by several software packages in Linux) to fix several memory corruption vulnerabilities. They are now fixed at commit 20230408 - see details here (https://invisible-island.net/ncurses/NEWS.html#index-t20230408) A CVE was assigned (CVE-2023-29491) - it's still under a "reserved" status.
Are there any plans to disclose any proofs of concept to test these issues? From the distro side these are not only useful to check which ncurses snapshots we need to fix, but also for our QA teams to test the update and detect regressions. For example, we are not sure if the build option `--disable-root-environ` does anything to mitigate the issues.
How can we ensure those fixes get deployed upstream, in major Linux distributions? We've reached out to Arch, RedHat, Canonical and other popular distros independently. Thanks! JBO
For what is worth, we have not been contacted, as far as I can tell. Best, Carlos -- Carlos López Security Engineer SUSE Software Solutions
Current thread:
- ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 12)
- Re: ncurses fixes upstream Sam James (Apr 13)
- Re: ncurses fixes upstream Georgi Guninski (Apr 15)
- Re: ncurses fixes upstream Solar Designer (Apr 15)
- Re: ncurses fixes upstream Georgi Guninski (Apr 15)
- Re: ncurses fixes upstream alice (Apr 13)
- Re: ncurses fixes upstream Mark Esler (Apr 13)
- Re: ncurses fixes upstream Tavis Ormandy (Apr 14)
- Re: ncurses fixes upstream Carlos López (Apr 19)
- RE: [EXTERNAL] Re: [oss-security] ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 19)
- Re: ncurses fixes upstream Solar Designer (Apr 19)
- Re: ncurses fixes upstream Tavis Ormandy (Apr 20)
- Re: ncurses fixes upstream Sevan Janiyan (Apr 21)
- RE: [EXTERNAL] Re: [oss-security] ncurses fixes upstream Jonathan Bar Or (JBO) (Apr 19)
- Re: ncurses fixes upstream Sam James (Apr 13)