CVE-2023-24809
Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process.
Does this matter?
Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.
Description
NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.24% probability · 15th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- nethack/nethack
- Source
- security-advisories@github.com
References
- https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgchVendor Advisory
- https://nethack.org/security/CVE-2023-24809.htmlVendor Advisory
- https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgchVendor Advisory
- https://nethack.org/security/CVE-2023-24809.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.