CVE-2020-5212 - NetHack MENUCOLOR configuration file option is subject to a buffer overflow

Back Back to CVE browser

CRITICAL

NetHack MENUCOLOR configuration file option is subject to a buffer overflow

Published Jan 28, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.07%

Description

In NetHack before 3.6.5, an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.

Affected products

Vendor NetHack Product NetHack Default
n/a
- Version
  < 3.6.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NetHack

n/a

Version	Status	Constraints
< 3.6.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26452
Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-g89f-m829-4m56
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26452		Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-g89f-m829-4m56		x_refsource_CONFIRMThird Party Advisory