CVE-2019-17594

MediumCVSS 5.3/10Last modified Oct 14, 2026

Description

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.htmlThird Party Advisory
https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.htmlExploit, Mailing List, Third Party Advisory
https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.htmlMailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202101-28Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.htmlThird Party Advisory
https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00017.htmlExploit, Mailing List, Third Party Advisory
https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.htmlMailing List, Patch, Third Party Advisory
https://security.gentoo.org/glsa/202101-28Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Oct 14, 2019
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-175955.4There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012 CVE-2019-175967.5Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There a CVE-2019-175987.5An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy CVE-2019-175996.1The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact i CVE-2019-17605.9A vulnerability in Performance Routing Version 3 (PfRv3) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause t CVE-2019-176009.8Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user is mishandled.CVE-2019-176019.8In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code e CVE-2019-176029.8An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. The OPMDeviceDetailsServlet servlet is prone to SQL injecti CVE-2019-176037.8Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows loc CVE-2019-176044.3An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidat CVE-2019-176058.8A mass assignment vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to take over another candidate's account (by also CVE-2019-176066.1The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of