Status of CVE-2018-19217

[Sylvain Beucler]

Hi,

As part of the Debian LTS project I'm triaging active ncurses
vulnerabilities.

For CVE-2018-19217, it seems nobody is able to reproduce the bug:
"In ncurses 6.1, there is a NULL pointer dereference at the function
_nc_name_match that will lead to a denial of service attack."
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19217
https://bugzilla.redhat.com/show_bug.cgi?id=1643753

I myself couldn't find a 6.1 version that crashes on this POC.
It was never properly reported to the ncurses project itself, so I'm
doing that now.

Do you consider this bug valid?
If not, I can request a rejection of this CVE.

Cheers!
Sylvain Beucler