Skip to content
Fencer Intel
high 7.8

CVE-2023-29491 json

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malfo…

published 3y ago modified last mo. also EUVD-2023-33058 , JLSEC-2026-453

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Patch / fix

  • julia Ncurses_jll 6.4.0+0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens RUGGEDCOM ROX MX5000 V2.17.0
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.0
  • Siemens RUGGEDCOM ROX RX1400 V2.17.0
  • Siemens RUGGEDCOM ROX RX1500 V2.17.0
  • Siemens RUGGEDCOM ROX RX1501 V2.17.0
  • Siemens RUGGEDCOM ROX RX1510 V2.17.0
  • Siemens RUGGEDCOM ROX RX1511 V2.17.0
  • Siemens RUGGEDCOM ROX RX1512 V2.17.0
  • Siemens RUGGEDCOM ROX RX1524 V2.17.0
  • Siemens RUGGEDCOM ROX RX1536 V2.17.0
  • Siemens RUGGEDCOM ROX RX5000 V2.17.0
  • ncurses Debian 14, Debian 13, Debian 12 6.4-3

debian advisories DEBIAN-CVE-2023-29491

  • ncurses Ubuntu 18.04 LTS 6.1-1ubuntu1.18.04.1
  • ncurses Ubuntu 20.04 LTS 6.2-0ubuntu2.1
  • ncurses Ubuntu 22.04 LTS 6.3-2ubuntu0.1
  • ncurses Ubuntu Pro 14.04 LTS 5.9+20140118-1ubuntu1+esm3
  • ncurses Ubuntu Pro 16.04 LTS 6.0+20160213-1ubuntu1+esm3

ubuntu advisories UBUNTU-CVE-2023-29491

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ncurses RHEL 9 6.2-10.20210508.el9
  • ncurses-base RHEL 9 6.2-10.20210508.el9
  • ncurses-libs RHEL 9 6.2-10.20210508.el9
  • ncurses-term RHEL 9 6.2-10.20210508.el9
  • ncurses-c++-libs RHEL 9 6.2-10.20210508.el9
  • ncurses RHEL 8 6.1-9.20180224.el8_8.1
  • ncurses-base RHEL 8 6.1-9.20180224.el8_8.1
  • ncurses-libs RHEL 8 6.1-9.20180224.el8_8.1

red hat advisories RHSA-2024:0416RHSA-2023:7361RHSA-2023:6698RHSA-2023:5249

  • ncurses SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 5.9-81.1
  • ncurses SLE Real Time 15 SP3, SLE Module for Legacy 15 SP4, SLE Module for Development Tools 15 SP4 +7 more 6.1-150000.5.15.1

suse advisories SUSE-SU-2023:2112-1SUSE-SU-2023:2111-1

  • ncurses AlmaLinux 9 6.2-10.20210508.el9
  • ncurses-base AlmaLinux 9 6.2-10.20210508.el9
  • ncurses-libs AlmaLinux 9 6.2-10.20210508.el9
  • ncurses-term AlmaLinux 9 6.2-10.20210508.el9
  • ncurses-c++-libs AlmaLinux 9 6.2-10.20210508.el9
  • ncurses AlmaLinux 8 6.1-9.20180224.el8_8.1
  • ncurses-base AlmaLinux 8 6.1-9.20180224.el8_8.1
  • ncurses-libs AlmaLinux 8 6.1-9.20180224.el8_8.1

almalinux advisories ALSA-2023:6698ALSA-2023:5249

  • ncurses Alpine 3.15 6.3_p20211120-r2
  • ncurses Alpine 3.16 6.3_p20220521-r1
  • ncurses Alpine 3.17 6.3_p20221119-r1
  • ncurses Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 6.4_p20230424-r0

alpine advisories ALPINE-CVE-2023-29491

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • ncurses CBL-Mariner 2.0 6.4-1

azure linux advisories AZL-26241

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2023-29491 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-29491 updated cvss 7.8

ncurses: Local users can trigger security-relevant memory corruption via malformed data

  • Red Hat Enterprise Linux 6 ncurses, ncurses-base, ncurses-libs, ncurses-term Red Hat Enterprise Linux 7 ncurses, ncurses-base, ncurses-libs, ncurses-term
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 9) ncurses-term 6.2-10.20210508.el9, ncurses-c++-libs 6.2-10.20210508.el9
    fixed: vendor fix RHSA-2023:6698
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) ncurses-term 6.2-8.20210508.el9_2.1, ncurses-c++-libs 6.2-8.20210508.el9_2.1
    fixed: vendor fix RHSA-2023:7361
  • Red Hat Enterprise Linux BaseOS (v. 8) ncurses 6.1-9.20180224.el8_8.1, ncurses-base 6.1-9.20180224.el8_8.1, ncurses-libs 6.1-9.20180224.el8_8.1, ncurses-term 6.1-9.20180224.el8_8.1, ncurses-c++-libs 6.1-9.20180224.el8_8.1, ncurses-compat-libs 6.1-9.20180224.el8_8.1
    fixed: vendor fix RHSA-2023:5249
  • Red Hat Enterprise Linux BaseOS (v. 9) ncurses 6.2-10.20210508.el9, ncurses-base 6.2-10.20210508.el9, ncurses-libs 6.2-10.20210508.el9
    fixed: vendor fix RHSA-2023:6698
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) ncurses 6.1-9.20180224.el8_6.1, ncurses-base 6.1-9.20180224.el8_6.1, ncurses-libs 6.1-9.20180224.el8_6.1, ncurses-term 6.1-9.20180224.el8_6.1, ncurses-c++-libs 6.1-9.20180224.el8_6.1, ncurses-compat-libs 6.1-9.20180224.el8_6.1
    fixed: vendor fix RHSA-2024:0416
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) ncurses 6.2-8.20210508.el9_2.1, ncurses-base 6.2-8.20210508.el9_2.1, ncurses-libs 6.2-8.20210508.el9_2.1
    fixed: vendor fix RHSA-2023:7361

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.8

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-14).

Exploits and checks

  • openwall.com http://www.openwall.com/lists/oss-security/2023/04/19/11 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia Ncurses_jll
<6.4.0+0
6.4.0+0

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Additional CPE mappings.