QSN-8709-1: ncurses vulnerability
2026-09-01

Summary:
ncurses could be made to crash if it opened a specially crafted file.

Details:
It was discovered that ncurses incorrectly handled specially crafted
terminfo database entries. A local attacker could possibly use this issue
to cause applications using ncurses to crash, resulting in a denial of
service.

Affected QuantaStor releases:
  6.9.1.001 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.1.001 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.1.001 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.1.001 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.1.001 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.1.001 jammy: ncurses-term 6.3-2ubuntu0.3 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.9.0.464 jammy: ncurses-term 6.3-2ubuntu0.3 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.6.015 jammy: ncurses-term 6.3-2ubuntu0.3 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.5.018 jammy: ncurses-term 6.3-2ubuntu0.2 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.4.038 jammy: ncurses-term 6.3-2ubuntu0.2 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.3.018 jammy: ncurses-term 6.3-2ubuntu0.2 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.2.002 jammy: ncurses-term 6.3-2ubuntu0.2 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.1.007 jammy: ncurses-term 6.3-2ubuntu0.2 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: libncurses6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: libncursesw6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: libtinfo6 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: ncurses-base 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: ncurses-bin 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)
  6.8.0.205 jammy: ncurses-term 6.3-2ubuntu0.1 (fixed in 6.3-2ubuntu0.3)

CVEs: CVE-2025-6141

References:
  https://ubuntu.com/security/notices/USN-8709-1