Skip to content

NetHack error recovery after syntax error in configuration file is subject to a buffer overflow

High
nhkeni published GHSA-p8fw-rq89-xqx6 Jan 27, 2020

Package

No package listed

Affected versions

>=3.6.0, <3.6.5

Patched versions

3.6.5

Description

Impact

Detecting an unknown configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation.

Applies to

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Patches

Users should upgrade to NetHack 3.6.5.

Workarounds

None.

References

Additional information, if any, will be made available at https://nethack.org/security.

Severity

High

CVE ID

CVE-2020-5214

Weaknesses

No CWEs