Source: nethack X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for nethack. CVE-2023-24809[0]: | NetHack is a single player dungeon exploration game. Starting with | version 3.6.2 and prior to version 3.6.7, illegal input to the "C" | (call) command can cause a buffer overflow and crash the NetHack | process. This vulnerability may be a security issue for systems that | have NetHack installed suid/sgid and for shared systems. For all | systems, it may result in a process crash. This issue is resolved in | NetHack 3.6.7. There are no known workarounds. https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf (v5.19.1) If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-24809 https://www.cve.org/CVERecord?id=CVE-2023-24809 Please adjust the affected versions in the BTS as needed.
