NetHack command line parsing of options starting with -de and -i is subject to a buffer overflow

In NetHack before 3.6.5, unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)

NetHack 缓冲区错误漏洞

NetHack是一款角色扮演类单人游戏。 NetHack 3.6.5之前版本中以-de和-i开头的未知选项存在缓冲区错误漏洞。远程攻击者可借助特制请利用该漏洞导致拒绝服务或提升权限。

N/A

N/A