CVE-2023-24809: NetHack Call command buffer overflow
NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-24809?
CVE-2023-24809 is considered to have a high severity due to its potential to cause a buffer overflow and crash the NetHack process.
How do I fix CVE-2023-24809?
To fix CVE-2023-24809, upgrade NetHack to version 3.6.7 or later.
What versions of NetHack are affected by CVE-2023-24809?
CVE-2023-24809 affects NetHack versions from 3.6.2 up to, but not including, 3.6.7.
What type of vulnerability is CVE-2023-24809?
CVE-2023-24809 is a buffer overflow vulnerability that can be triggered by illegal input to the call command.
Is CVE-2023-24809 a security risk for online users?
Yes, CVE-2023-24809 may pose a security risk for systems that run vulnerable versions of NetHack.