What is CVE-2021-39537?

CVE-2021-39537 is a high-severity software vulnerability (Out-of-bounds write) with a CVSS score of 8.8. An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Is CVE-2021-39537 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 3%.

What products does CVE-2021-39537 affect?

Tracked products affected include macOS, OS X. Check the version you run to see whether it is affected.

How do I fix CVE-2021-39537?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2021-39537

HIGH severity · CVSS 8.8 · Out-of-bounds write

8.8CVSS HIGH

Summary

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)3%

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (2)

macOS OS X

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup ↗

Additional information

NVD record
http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markupPatch
https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.htmlAdvisory
https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.htmlAdvisory
http://seclists.org/fulldisclosure/2022/Oct/28Advisory
http://seclists.org/fulldisclosure/2022/Oct/41Advisory
http://seclists.org/fulldisclosure/2022/Oct/43Advisory
http://seclists.org/fulldisclosure/2022/Oct/45Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html