CVE-2020-5253

NameCVE-2020-5253
DescriptionNetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nethack (PTS)stretch3.6.0-4fixed
buster3.6.1-1fixed
bookworm, bullseye, sid3.6.6-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nethacksourcejessie(unfixed)end-of-life
nethacksource(unstable)3.6.0-1

Notes

[jessie] - nethack <end-of-life> (Not supported in jessie LTS)
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m
https://github.com/NetHack/NetHack/commit/612755bfb5c412079795c68ba392df5d93874ed8

Search for package or bug name: Reporting problems