Security readout for executives and security teams
Plain-English summary
CVE-2017-11113 is a crash bug in ncurses 6.0. If software uses terminfo library code on untrusted terminfo data, an attacker could trigger a denial of service. The provided sources do not show data theft, code execution, CVSS scoring, or confirmed active exploitation.
Executive priority
Prioritize remediation where ncurses terminfo parsing is reachable from users or remote data. For ordinary endpoints and servers without that data path, treat this as a lower-urgency hygiene update pending vendor guidance.
Technical view
The issue is a NULL pointer dereference in _nc_parse_entry in tinfo/parse_entry.c in ncurses 6.0. The stated impact is remote denial of service only when untrusted terminfo data is processed. Affected product metadata is incomplete in the bundle beyond ncurses 6.0.
Likely exposure
Exposure is most likely on systems or applications that accept, import, compile, or parse terminfo data from untrusted users. General systems with ncurses installed but no untrusted terminfo processing have less clear practical exposure from the provided evidence.
Exploitation context
The bundle does not identify known exploitation in the wild, and KEV status is false. The described attack condition requires untrusted terminfo data reaching ncurses parsing logic. No exploit details or broader impact are supported by the supplied sources.
Researcher notes
Key uncertainty is exposure mapping: the CVE record gives the vulnerable function and condition, but the bundle lacks CVSS, CWE, detailed affected package ranges, and patch identifiers. Validate through distribution advisories rather than assuming all ncurses deployments are exploitable.
Mitigation direction
- Check operating system or distribution guidance for ncurses updates addressing CVE-2017-11113.
- Update ncurses packages where vendor advisories recommend doing so.
- Do not process terminfo data from untrusted sources unless required.
- Constrain services that must parse user-supplied terminal capability data.
- Track Gentoo and Red Hat advisory status for environment-specific remediation details.
Validation and detection
- Inventory systems for ncurses 6.0 or vendor packages referencing CVE-2017-11113.
- Identify applications that accept or generate terminfo data from users or remote inputs.
- Review vendor package changelogs for CVE-2017-11113 fixes.
- Confirm no exposed service path processes untrusted terminfo data.
- Document compensating controls where package updates are unavailable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11113 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- GLSA-201804-13CVE reference · vendor-advisory, x_refsource_GENTOO
- https://bugzilla.redhat.com/show_bug.cgi?id=1464691CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.