LiveActive security incident?Get immediate response
CVE Record

CVE-2017-10685: In ncurses 6.0, there is a format string vulnerability in the fmt_entry function.

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2017-10685 is reported as a format string flaw in ncurses 6.0. The source description says crafted input can lead to remote arbitrary code execution. Business urgency depends on whether exposed systems use affected ncurses packages and process attacker-controlled terminal capability data or related input.

Executive priority

Treat as a high-priority library exposure review because the described impact is remote code execution. Prioritize assets where ncurses is present and untrusted input can reach terminal capability parsing. Defer exploit-status claims until vendor or KEV evidence supports them.

Technical view

The vulnerability is in the ncurses fmt_entry function. The public bundle describes a format string condition in ncurses 6.0 with potential remote arbitrary code execution from crafted input. No CVSS, CWE, complete affected package matrix, or detailed fix version is included in the provided sources.

Likely exposure

Most exposure is likely on Linux or Unix-like systems with vulnerable ncurses packages, especially where applications ingest untrusted terminal database or terminal capability content. Exact distribution exposure is not established in the provided bundle and should be verified through vendor advisories.

Exploitation context

The bundle does not show CISA KEV listing or cited evidence of active exploitation. It states crafted input can cause remote arbitrary code execution, but does not provide exploit maturity, required privileges, network path, or real-world attack details.

Researcher notes

Evidence is limited to the CVE description and vendor references. Avoid assuming all ncurses consumers are remotely exploitable. Focus analysis on fmt_entry reachability, downstream package patches, and whether attacker-controlled input can influence ncurses parsing in the target environment.

Mitigation direction

  • Check vendor guidance for ncurses package applicability and fixed versions.
  • Prioritize vendor-provided ncurses updates on internet-facing or multi-user systems.
  • Review Gentoo GLSA-201804-13 and Red Hat Bugzilla status for distro-specific guidance.
  • Limit processing of untrusted terminal capability data where operationally feasible.

Validation and detection

  • Inventory ncurses package versions across hosts, containers, images, and appliances.
  • Compare installed versions against applicable vendor advisories and package changelogs.
  • Identify services or workflows that process untrusted terminal capability content.
  • Confirm remediated systems run vendor-fixed packages after updates.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-10685 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.