CVE-2020-5213 - NetHack SYMBOL configuration file option is subject to a buffer overflow

Back Back to CVE browser

CRITICAL

NetHack SYMBOL configuration file option is subject to a buffer overflow

Published Jan 28, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.07%

Description

In NetHack before 3.6.5, too long of a value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.

Affected products

Vendor NetHack Product NetHack Default
unknown
Affected
- < 3.6.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
NetHack	NetHack	unknown	Affected < 3.6.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26453
Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-rr25-4v34-pr7v
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26453		Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-rr25-4v34-pr7v		x_refsource_CONFIRMThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Jan 28, 2020

Updated Aug 4, 2024

Reserved Jan 2, 2020

Link CVE-2020-5213

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-5213

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Jan 28, 2020

Updated Aug 4, 2024

Link EUVD-2020-26453

GitHub

No data