diff -Nru ncurses-6.4/debian/changelog ncurses-6.4/debian/changelog --- ncurses-6.4/debian/changelog 2023-01-25 20:21:49.000000000 +0000 +++ ncurses-6.4/debian/changelog 2023-05-16 18:25:33.000000000 +0000 @@ -1,3 +1,18 @@ +ncurses (6.4-2ubuntu0.1) lunar-security; urgency=medium + + * SECURITY UPDATE: memory corruption when processing malformed terminfo data + entries loaded by setuid/setgid programs + - debian/patches/CVE-2023-29491-mitigation-1.patch: fix copy/paste error + in configure.in. + - debian/patches/CVE-2023-29491-mitigation-2.patch: change the + --disable-root-environ configure option behavior. + - debian/rules: set --disable-root-environ in configuration options. + - debian/libtinfo5.symbols, debian/libtinfo6.symbols: add _nc_env_access + to symbols files. + - CVE-2023-29491 + + -- Camila Camargo de Matos Tue, 16 May 2023 15:25:33 -0300 + ncurses (6.4-2) unstable; urgency=medium * Add Breaks against vim-common (<< 2:9.0.1000-2) to ncurses-base diff -Nru ncurses-6.4/debian/control ncurses-6.4/debian/control --- ncurses-6.4/debian/control 2023-01-22 16:56:10.000000000 +0000 +++ ncurses-6.4/debian/control 2023-05-16 18:25:33.000000000 +0000 @@ -1,7 +1,8 @@ Source: ncurses Section: libs Priority: required -Maintainer: Craig Small +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Craig Small Uploaders: Sven Joachim Build-Depends: debhelper-compat (= 13), libgpm-dev [linux-any], diff -Nru ncurses-6.4/debian/lib32tinfo6.symbols ncurses-6.4/debian/lib32tinfo6.symbols --- ncurses-6.4/debian/lib32tinfo6.symbols 2023-01-22 16:54:52.000000000 +0000 +++ ncurses-6.4/debian/lib32tinfo6.symbols 2023-05-16 18:25:33.000000000 +0000 @@ -94,6 +94,7 @@ _nc_curr_col@NCURSES6_TINFO_5.0.19991023 6 _nc_curr_line@NCURSES6_TINFO_5.0.19991023 6 _nc_doalloc@NCURSES6_TINFO_5.0.19991023 6 + _nc_env_access@NCURSES6_TINFO_5.2.20001021 6.4-2ubuntu0.1 _nc_err_abort@NCURSES6_TINFO_5.0.19991023 6 _nc_export_termtype2@NCURSES6_TINFO_6.1.20171230 6.1 _nc_fallback2@NCURSES6_TINFO_6.1.20171230 6.1 diff -Nru ncurses-6.4/debian/lib64tinfo6.symbols ncurses-6.4/debian/lib64tinfo6.symbols --- ncurses-6.4/debian/lib64tinfo6.symbols 2023-01-22 16:54:52.000000000 +0000 +++ ncurses-6.4/debian/lib64tinfo6.symbols 2023-05-16 18:25:33.000000000 +0000 @@ -94,6 +94,7 @@ _nc_curr_col@NCURSES6_TINFO_5.0.19991023 6 _nc_curr_line@NCURSES6_TINFO_5.0.19991023 6 _nc_doalloc@NCURSES6_TINFO_5.0.19991023 6 + _nc_env_access@NCURSES6_TINFO_5.2.20001021 6.4-2ubuntu0.1 _nc_err_abort@NCURSES6_TINFO_5.0.19991023 6 _nc_export_termtype2@NCURSES6_TINFO_6.1.20171230 6.1 _nc_fallback2@NCURSES6_TINFO_6.1.20171230 6.1 diff -Nru ncurses-6.4/debian/libtinfo5.symbols ncurses-6.4/debian/libtinfo5.symbols --- ncurses-6.4/debian/libtinfo5.symbols 2023-01-22 16:54:52.000000000 +0000 +++ ncurses-6.4/debian/libtinfo5.symbols 2023-05-16 18:25:33.000000000 +0000 @@ -95,6 +95,7 @@ _nc_curr_col@NCURSES_TINFO_5.0.19991023 6 _nc_curr_line@NCURSES_TINFO_5.0.19991023 6 _nc_doalloc@NCURSES_TINFO_5.0.19991023 6 + _nc_env_access@NCURSES_TINFO_5.2.20001021 6.4-2ubuntu0.1 _nc_err_abort@NCURSES_TINFO_5.0.19991023 6 _nc_fallback@NCURSES_TINFO_5.0.19991023 6 _nc_find_entry@NCURSES_TINFO_5.0.19991023 6 diff -Nru ncurses-6.4/debian/libtinfo6.symbols ncurses-6.4/debian/libtinfo6.symbols --- ncurses-6.4/debian/libtinfo6.symbols 2023-01-22 16:54:52.000000000 +0000 +++ ncurses-6.4/debian/libtinfo6.symbols 2023-05-16 18:25:33.000000000 +0000 @@ -94,6 +94,7 @@ _nc_curr_col@NCURSES6_TINFO_5.0.19991023 6 _nc_curr_line@NCURSES6_TINFO_5.0.19991023 6 _nc_doalloc@NCURSES6_TINFO_5.0.19991023 6 + _nc_env_access@NCURSES6_TINFO_5.2.20001021 6.4-2ubuntu0.1 _nc_err_abort@NCURSES6_TINFO_5.0.19991023 6 _nc_export_termtype2@NCURSES6_TINFO_6.1.20171230 6.1 _nc_fallback2@NCURSES6_TINFO_6.1.20171230 6.1 diff -Nru ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-1.patch ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-1.patch --- ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-1.patch 1970-01-01 00:00:00.000000000 +0000 +++ ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-1.patch 2023-05-16 18:20:14.000000000 +0000 @@ -0,0 +1,24 @@ +Author: Sven Joachim +Description: Fix copy/paste error in configure.in + Fix the --disable-root-access and --disableroot-environ configure + options. Due to a copy/paste error, the latter performs the actions + of the former, while the --disable-root-access option has no effect + at all. +Forwarded: https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00003.html +Last-Update: 2023-05-01 + +--- + configure.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/configure.in ++++ b/configure.in +@@ -868,7 +868,7 @@ AC_MSG_RESULT($with_root_environ) + test "x$with_root_environ" = xyes && AC_DEFINE(USE_ROOT_ENVIRON,1,[Define to 1 if root is allowed to use ncurses environment]) + + AC_MSG_CHECKING(if you want to permit setuid programs to access all files) +-AC_ARG_ENABLE(root-environ, ++AC_ARG_ENABLE(root-access, + [ --disable-root-access restrict file-access when running setuid], + [with_root_access=$enableval], + [with_root_access=yes]) diff -Nru ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-2.patch ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-2.patch --- ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-2.patch 1970-01-01 00:00:00.000000000 +0000 +++ ncurses-6.4/debian/patches/CVE-2023-29491-mitigation-2.patch 2023-05-16 18:20:14.000000000 +0000 @@ -0,0 +1,27 @@ +Author: Sven Joachim +Description: Change the --disable-root-environ configure option behavior + By default, the --disable-root-environ option forbids program run by + the superuser to load custom terminfo entries. This patch changes + that to only restrict programs running with elevated privileges, + matching the behavior of the --disable-setuid-environ option + introduced in the 20230423 upstream patchlevel. +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034372#29 +Bug: https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00018.html +Forwarded: not-needed +Last-Update: 2023-05-01 + +--- + ncurses/tinfo/access.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/ncurses/tinfo/access.c ++++ b/ncurses/tinfo/access.c +@@ -215,8 +215,6 @@ _nc_env_access(void) + + if (is_elevated()) { + result = FALSE; +- } else if ((getuid() == ROOT_UID) || (geteuid() == ROOT_UID)) { +- result = FALSE; + } + return result; + } diff -Nru ncurses-6.4/debian/patches/series ncurses-6.4/debian/patches/series --- ncurses-6.4/debian/patches/series 2023-01-22 17:31:25.000000000 +0000 +++ ncurses-6.4/debian/patches/series 2023-05-16 18:20:14.000000000 +0000 @@ -3,3 +3,5 @@ 02-debian-xterm.diff 03-debian-ncursesconfig-omit-L.diff fix_crash_on_very_long_tc-use_clause.diff +CVE-2023-29491-mitigation-1.patch +CVE-2023-29491-mitigation-2.patch diff -Nru ncurses-6.4/debian/rules ncurses-6.4/debian/rules --- ncurses-6.4/debian/rules 2023-01-22 18:46:39.000000000 +0000 +++ ncurses-6.4/debian/rules 2023-05-16 18:25:33.000000000 +0000 @@ -148,6 +148,7 @@ --without-progs \ $(with_mouse) \ --enable-symlinks \ + --disable-root-environ \ --disable-termcap \ --with-default-terminfo-dir=/etc/terminfo \ --with-terminfo-dirs="/etc/terminfo:/lib/terminfo:/usr/share/terminfo" \