[Debian] High CVE: CVE-2023-29491 ncurses: trigger security-relevant memory corruption

[Yue Tao]

CVE-2023-29491: https://nvd.nist.gov/vuln/detail/CVE-2023-29491

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Base Score: High

Reference:

['libncursesw5-dev_6.2+20201114-2+deb11u1_amd64.deb===>libncursesw5-dev_6.2+20201114-2+deb11u2_amd64.deb', 'libncurses5-dev_6.2+20201114-2+deb11u1_amd64.deb===>libncurses5-dev_6.2+20201114-2+deb11u2_amd64.deb', 'libncurses-dev_6.2+20201114-2+deb11u1_amd64.deb===>libncurses-dev_6.2+20201114-2+deb11u2_amd64.deb', 'libncurses6_6.2+20201114-2+deb11u1_amd64.deb===>libncurses6_6.2+20201114-2+deb11u2_amd64.deb', 'libncursesw6_6.2+20201114-2+deb11u1_amd64.deb===>libncursesw6_6.2+20201114-2+deb11u2_amd64.deb', 'libtinfo6_6.2+20201114-2+deb11u1_amd64.deb===>libtinfo6_6.2+20201114-2+deb11u2_amd64.deb', 'ncurses-base_6.2+20201114-2+deb11u1_all.deb===>ncurses-base_6.2+20201114-2+deb11u2_all.deb', 'ncurses-bin_6.2+20201114-2+deb11u1_amd64.deb===>ncurses-bin_6.2+20201114-2+deb11u2_amd64.deb']

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/899536

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/899536
Committed: https://opendev.org/starlingx/tools/commit/2dede738988c517c51b4971cb0cf0f82453c60f9
Submitter: "Zuul (22348)"
Branch: master

commit 2dede738988c517c51b4971cb0cf0f82453c60f9
Author: Peng Zhang <email address hidden>
Date: Tue Oct 24 07:56:21 2023 +0000

    Debian: ncurses: fix CVE-2023-29491

    Upgrade libncursesw5, libncurses5-dev, libncurses-dev, libncurses6,
    libncursesw6, libtinfo6, ncurses-base, ncurses-bin package from
    6.2+20201114-2+deb11u1 to 6.2+20201114-2+deb11u2 fix CVE-2023-29491.

    Refer to:
    https://nvd.nist.gov/vuln/detail/CVE-2023-29491

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2038881

    Change-Id: I09b3a70b1ae029a4493b24141e8f11f4d40a637b
    Signed-off-by: Peng Zhang <email address hidden>