Executive brief
GNU ncurses is a widely used programming library that allows developers to write text-based user interfaces in a terminal-independent manner. A vulnerability was found that could allow a local user to cause a crash or potentially execute unauthorized code by providing a specially crafted terminal description file. This could lead to a denial of service for applications relying on the library or a compromise of the local system's stability.
Technical details
A stack-based buffer overflow exists in the postprocess_termcap function within tinfo/parse_entry.c of GNU ncurses. The vulnerability is triggered during the manipulation of long strings in terminal description files, specifically affecting the 'buf2' variable. A local attacker can exploit this by providing a malformed termcap entry to tools like 'tic' (the terminal information compiler). This can result in a crash (denial of service) or potentially arbitrary code execution under the context of the user running the utility. The issue is addressed in version 6.5-20250329.
Affected products
- GNU ncurses up to 6.5-20250322
Timeline
- 2025-03-24: disclosed: Vulnerability reported to bug-ncurses mailing list
- 2025-03-29: patched: Fixed in ncurses version 6.5-20250329
- 2025-06-16: advisory: CVE-2025-6141 published
References
- https://invisible-island.net/ncurses/NEWS.html
- https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00107.html
- https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00109.html
- https://lists.gnu.org/archive/html/bug-ncurses/2025-03/msg00114.html
- https://vuldb.com/?ctiid.312610
- https://vuldb.com/?id.312610
- https://vuldb.com/?submit.593000