CVE-2020-5253

NameCVE-2020-5253
DescriptionNetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nethack (PTS)jessie3.4.3-15vulnerable
stretch3.6.0-4fixed
buster3.6.1-1fixed
bullseye3.6.6-2fixed
bookworm3.6.6-3fixed
sid, trixie3.6.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nethacksourcewheezy(unfixed)end-of-life
nethacksourcejessie(unfixed)end-of-life
nethacksource(unstable)3.6.0-1

Notes

[jessie] - nethack <end-of-life> (Not supported in jessie LTS)
https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m
https://github.com/NetHack/NetHack/commit/612755bfb5c412079795c68ba392df5d93874ed8

Search for package or bug name: Reporting problems