==========================================================================
Ubuntu Security Notice USN-6684-1
March 07, 2024

ncurses vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 18.04 LTS (Available with Ubuntu Pro)
• Ubuntu 16.04 LTS (Available with Ubuntu Pro)
• Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

ncurses could be made to crash if it received specially crafted
input.

Software Description:

• ncurses: shared libraries for terminal handling

Details:

It was discovered that ncurses incorrectly handled certain function return
values, possibly leading to segmentation fault. A local attacker could possibly
use this to cause a denial of service (system crash).

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
lib32ncurses5 6.1-1ubuntu1.18.04.1+esm2
lib32tinfo5 6.1-1ubuntu1.18.04.1+esm2
lib64ncurses5 6.1-1ubuntu1.18.04.1+esm2
lib64tinfo5 6.1-1ubuntu1.18.04.1+esm2
libncurses5 6.1-1ubuntu1.18.04.1+esm2
libtinfo5 6.1-1ubuntu1.18.04.1+esm2
libx32ncurses5 6.1-1ubuntu1.18.04.1+esm2
libx32tinfo5 6.1-1ubuntu1.18.04.1+esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
lib32ncurses5 6.0+20160213-1ubuntu1+esm5
lib32tinfo5 6.0+20160213-1ubuntu1+esm5
lib64ncurses5 6.0+20160213-1ubuntu1+esm5
lib64tinfo5 6.0+20160213-1ubuntu1+esm5
libncurses5 6.0+20160213-1ubuntu1+esm5
libtinfo5 6.0+20160213-1ubuntu1+esm5
libx32ncurses5 6.0+20160213-1ubuntu1+esm5
libx32tinfo5 6.0+20160213-1ubuntu1+esm5

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
lib32ncurses5 5.9+20140118-1ubuntu1+esm5
lib32tinfo5 5.9+20140118-1ubuntu1+esm5
lib64ncurses5 5.9+20140118-1ubuntu1+esm5
lib64tinfo5 5.9+20140118-1ubuntu1+esm5
libncurses5 5.9+20140118-1ubuntu1+esm5
libtinfo5 5.9+20140118-1ubuntu1+esm5
libx32ncurses5 5.9+20140118-1ubuntu1+esm5
libx32tinfo5 5.9+20140118-1ubuntu1+esm5

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6684-1
CVE-2023-50495