Skip to content

NetHack SYMBOL configuration file option is subject to a buffer overflow

High
nhkeni published GHSA-rr25-4v34-pr7v Jan 27, 2020

Package

No package listed

Affected versions

>=3.6.0, <3.6.5

Patched versions

3.6.5

Description

Impact

Too long value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation.

Applies to

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Patches

Users should upgrade to NetHack 3.6.5.

Workarounds

None.

References

Additional information, if any, will be made available at https://nethack.org/security.

Severity

High

CVE ID

CVE-2020-5213

Weaknesses

No CWEs