Ncurses

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:gnu:ncurses:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorGnu (575dd98a-a14a-5d9e-a2eb-97d38d86fcb9)
ProductNcurses (75154d04-2754-5378-ab4c-de1c9fca34fe)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ncurses purl2cpe 2026-06-01 10:11:53.417149
pkg:deb/ubuntu/ncurses purl2cpe 2026-06-01 10:11:53.417154
pkg:github/mitchelhaan/ncurses purl2cpe 2026-06-01 10:11:53.417156
pkg:github/werehamster/ncurses purl2cpe 2026-06-01 10:11:53.417157
pkg:gitlab/redhat/ncurses purl2cpe 2026-06-01 10:11:53.417159
pkg:gnu/ncurses purl2cpe 2026-06-01 10:11:53.417160
pkg:rpm/centos/ncurses purl2cpe 2026-06-01 10:11:53.417162
pkg:rpm/fedora/ncurses purl2cpe 2026-06-01 10:11:53.417163
pkg:rpm/opensuse/ncurses purl2cpe 2026-06-01 10:11:53.417164

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-6141 vulnerable 2026-06-08 07:43:14.376441 GNU ncurses parse_entry.c postprocess_termcap stack-based overflow
LOW (3.3)
A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. Upgrading to version 6.5-20250329 is able to address this issue. It is recommended to upgrade the affected component.
Published: 2025-06-16T22:00:17.088Z
Updated: 2026-06-02T12:59:41.864Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-69720 vulnerable 2026-06-08 07:43:13.756230 Details available
HIGH (7.3)
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c.
Published: 2026-03-19T00:00:00.000Z
Updated: 2026-06-02T13:00:33.095Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29491 vulnerable 2026-06-08 06:02:40.339601 Details available
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.
Published: 2023-04-14T00:00:00.000Z
Updated: 2025-11-04T18:14:36.678Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-29458 vulnerable 2026-06-08 05:42:47.806061 Details available
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.
Published: 2022-04-18T00:00:00.000Z
Updated: 2025-06-09T14:53:36.453Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-39537 vulnerable 2026-06-08 05:33:50.244188 Details available
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.
Published: 2021-09-20T00:00:00.000Z
Updated: 2024-08-04T02:06:42.632Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-17595 vulnerable 2026-06-08 05:13:10.788074 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-17594 vulnerable 2026-06-08 05:13:10.787477 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2002-0062 vulnerable 2026-06-08 04:46:20.545402 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2000-0963 vulnerable 2026-06-08 04:45:19.034322 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.