CVE-2020-5253 - Privilege escalation in NetHack

Back Back to CVE browser

CRITICAL

Privilege escalation in NetHack

Published Mar 10, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 0.54%

Description

NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.

Affected products

Vendor NetHack Product NetHack Default
n/a
- Version
  < 3.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NetHack

n/a

Version	Status	Constraints
< 3.6.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-184

CWE-269

Improper Privilege Management

References (2)

https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8
x_refsource_MISCPatchThird Party Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8		x_refsource_MISCPatchThird Party Advisory
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m		x_refsource_CONFIRMThird Party Advisory