Skip to content

NetHack command line parsing of options starting with -de and -i is subject to a buffer overflow

High
nhkeni published GHSA-fw72-r8xm-45p8 Jan 27, 2020

Package

No package listed

Affected versions

>=3.6.0, <3.6.5

Patched versions

3.6.5

Description

Impact

Unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation.

Applies to

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options.

Patches

Users should upgrade to NetHack 3.6.5.

Workarounds

None.

References

Additional information, if any, will be made available at https://nethack.org/security.

Severity

High

CVE ID

CVE-2020-5209

Weaknesses

No CWEs