What’s Vulnerable › Vulnerabilities

CVE-2000-0963

• Severity: high (CVSS 7.2 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2000-12-19 · updated 2026-09-23

Description

Buffer overflow in ncurses library allows local users to execute arbitrary commands via long environmental information such as TERM or TERMINFO_DIRS.

Affected products

• FreeBSD: 3.4, 3.5.1, 4.0, 4.1, 4.1.1, 4.1.1-stable
• Immunix: 6.2, 7.0_beta
• GNU ncurses: before 5.6 — fixed in 5.6
• RedHat Linux: 6.2, 7.0

How to fix

Upgrade to a fixed version: GNU ncurses 5.6. Check the vendor advisory for mitigations.

References

• http://www.calderasystems.com/support/security/advisories/CSSA-2000-036.0.txt
• http://www.securityfocus.com/archive/1/138550
• http://www.securityfocus.com/bid/1142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44487
• http://www.calderasystems.com/support/security/advisories/CSSA-2000-036.0.txt
• http://www.securityfocus.com/archive/1/138550
• http://www.securityfocus.com/bid/1142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44487

Get alerted when CVE-2000-0963 or the next vulnerability affects your stack