Skip to content

NetHack AUTOCOMPLETE configuration file option is subject to a buffer overflow

High
nhkeni published GHSA-r788-4jf4-r9f7 Jan 27, 2020

Package

No package listed

Affected versions

>=3.6.0, <3.6.5

Patched versions

3.6.5

Description

Impact

Invalid extended command in value for the AUTOCOMPLETE configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation.

Applies to

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Patches

Users should upgrade to NetHack 3.6.5.

Workarounds

None.

References

Additional information, if any, will be made available at https://nethack.org/security.

Severity

High

CVE ID

CVE-2020-5211

Weaknesses

No CWEs