The advisory is at LWN.net: The version of the ncurses library shipped with Debian GNU/Linux 2.2 is vulnerable to several buffer overflows in the parsing of terminfo database files.