CVE-2020-5209

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-5209
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-5209.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-5209
Downstream
Related
Published
2020-01-28T18:15:11Z
Modified
2025-09-19T12:19:02.807571Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.

References

Affected packages

Git / github.com/nethack/nethack

Affected ranges

Type
GIT
Repo
https://github.com/nethack/nethack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f3def5c0b999478da2d0a8f0b6a7c370a2065f77

Affected versions

Other

MOVE2GIT

NetHack-3.*

NetHack-3.6.0_RC01
NetHack-3.6.0_RC02
NetHack-3.6.0_RC03
NetHack-3.6.0_RC04
NetHack-3.6.0_RC05
NetHack-3.6.0_Release
NetHack-3.6.1_RC01
NetHack-3.6.1_Release
NetHack-3.6.2_Release
NetHack-3.6.2_Released
NetHack-3.6.3.beta1.2019.11.17
NetHack-3.6.3.wip.2019.10.29
NetHack-3.6.3.wip.2019.10.30
NetHack-3.6.3.wip.2019.11.04
NetHack-3.6.3_Released
NetHack-3.6.3_WIP
NetHack-3.6.4_Released

v3.*

v3.6.3.757eca7
v3.6.3.wip.2019.10.29

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "310830547162893224554599239014636806229",
                    "34018820599253730327709495934594299296",
                    "317225028476795745372107821617322743833",
                    "129609102664991773702097279054587424331",
                    "45378429732371276794293173907064817784",
                    "241454483409671680544040774729902404698",
                    "149353208139140988394970222965860121246",
                    "53005647659553145399784742355349458457",
                    "279442050954566056719610912906832870671",
                    "32054647461642218857189089395108982167",
                    "235111810993396765755956616487926850976",
                    "45378429732371276794293173907064817784",
                    "241454483409671680544040774729902404698",
                    "164566155690431377469522275781391668811",
                    "286170278300611490354691993875451927576",
                    "75407180318704451699303769443305508093",
                    "303014031863806519995615049820224845999"
                ]
            },
            "id": "CVE-2020-5209-43e29dc6",
            "source": "https://github.com/nethack/nethack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "sys/unix/unixmain.c"
            },
            "deprecated": false
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "237238631063296251006144018346673050574",
                    "41567080869605892763766933027668991111",
                    "321500404367367614574791705014071388786",
                    "32480354964781786051202560298652743524",
                    "121849526889383195702811084542056977169",
                    "316478146209911481076334286682992552367",
                    "126436293461250905056760455306129061267",
                    "195068358581375276627708135070540722944",
                    "197312668687739141795870205028744559684",
                    "17406290654842088973518909861769966865",
                    "254415618829491615975835525967253343944",
                    "125978380080712942028817202667769445249",
                    "3923122635708738405805642073433724736",
                    "316294812572794505879779794798027619718"
                ]
            },
            "id": "CVE-2020-5209-ac76e6ec",
            "source": "https://github.com/nethack/nethack/commit/f3def5c0b999478da2d0a8f0b6a7c370a2065f77",
            "signature_type": "Line",
            "signature_version": "v1",
            "target": {
                "file": "src/windows.c"
            },
            "deprecated": false
        }
    ]
}