CVE-2020-5209

Published: 28 January 2020

In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
nethack Launchpad, Ubuntu, Debian	Upstream	Released (2.6.5)

	Ubuntu 20.10 (Groovy Gorilla)	Not vulnerable (3.6.6-1)
	Ubuntu 20.04 LTS (Focal Fossa)	Needs triage
	Ubuntu 18.04 LTS (Bionic Beaver)	Needs triage
	Ubuntu 16.04 LTS (Xenial Xerus)	Needs triage
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist

Notes

Author	Note
msalvatore	Nethack is installed sgid games, but not suid or sgid root.

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM