Skip to content

NetHack command line -w option parsing is subject to a buffer overflow

High
nhkeni published GHSA-v5pg-hpjg-9rpp Jan 27, 2020

Package

No package listed

Affected versions

>=3.6.0, <3.6.5

Patched versions

3.6.5

Description

Impact

Invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation.

Applies to

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options.

Patches

Users should upgrade to NetHack 3.6.5.

Workarounds

None.

References

Additional information, if any, will be made available at https://nethack.org/security.

Severity

High

CVE ID

CVE-2020-5210

Weaknesses

No CWEs