by Kastro
Paper/Archive/CVE-2020-5253

CVE-2020-5253

NetHack NetHack — Privilege escalation in NetHack

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.6.456 × 209.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0.

Affected

ProductAffectedFixed inSource
NetHack< 3.6.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)3.9CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

refgithub.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223mrefgithub.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8