From owner-freebsd-security Tue Nov 7 1:20:47 2000 Delivered-To: freebsd-security@freebsd.org Received: from blues.jpj.net (blues.jpj.net [204.97.17.146]) by hub.freebsd.org (Postfix) with ESMTP id 20D5537B6B9 for ; Tue, 7 Nov 2000 01:20:39 -0800 (PST) Received: from localhost (trevor@localhost) by blues.jpj.net (right/backatcha) with ESMTP id eA79Kbg20696; Tue, 7 Nov 2000 04:20:37 -0500 (EST) Date: Tue, 7 Nov 2000 04:20:37 -0500 (EST) From: Trevor Johnson To: Cy Schubert - ITSD Open Systems Group Cc: freebsd-security@FreeBSD.ORG Subject: Re: ncurses buffer overflows (fwd) In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org A few minutes ago, I wrote: > The older libcurses present in FreeBSD 2.x > and 3.x has not been sufficiently tested for the vulnerabilities discussed in > this advisory. However, according to a report by Valentin Nechayev, FreeBSD > 3.5-STABLE does not exhibit them. Now I notice http://www.securityfocus.com/templates/advisory.html?id=2269 which says that ncurses 1.8.6 in FreeBSD 3.4 has a problem which sounds like the same one. -- Trevor Johnson http://jpj.net/~trevor/gpgkey.txt To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message