CVE-2022-29458: 
NixOS vulnerability analysis and mitigation

ncurses 6.3 before patch 20220416 contains an out-of-bounds read vulnerability and segmentation violation in the convertstrings function located in tinfo/readentry.c within the terminfo library. The vulnerability was discovered in April 2022 and assigned identifier CVE-2022-29458 (NVD).

The vulnerability is characterized by an out-of-bounds read and segmentation violation that occurs in the convertstrings function within tinfo/readentry.c component of the terminfo library. The issue has been assigned a CVSS v3.1 base score of 7.1 HIGH with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H (NVD).

When exploited, this vulnerability can lead to a denial-of-service condition or potentially disclose memory contents. The vulnerability affects the system's confidentiality and availability, with potential exposure of sensitive information through memory disclosure (Apple Security).

The vulnerability was patched in ncurses version 6.3 with patch 20220416. Various distributions have released security updates to address this issue, including Debian which fixed it in version 6.1+20181013-2+deb10u3 (Debian Advisory). Users are advised to upgrade to the patched versions.