Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-19905: NetHack 3.6.x may crash or be compromised by long config file lines
CVE-2019-19905 · published 6 years ago
Summary
If NetHack is installed with extra permissions, hackers can potentially exploit a flaw in how it reads configuration files. This could allow them to run unauthorized code or crash the game. To protect your system, update to version 3.6.4 or later.
What to do
- Update nethack nethack to version 3.6.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nethack | nethack |
>= 3.6.0, < 3.6.4 cpe:2.3:a:nethack:nethack:*:*:*:*:*:*:*:* |
Original advisory text
NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid, and shared ...
NetHack 3.6.x before 3.6.4 is prone to a buffer overflow vulnerability when reading very long lines from configuration files. This affects systems that have NetHack installed suid/sgid, and shared systems that allow users to upload their own configuration files.
References
- https://bugs.debian.org/947005 Issue Tracking Patch Third Party Advisory
- https://github.com/NetHack/NetHack/commit/f001de79542b8c38b1f8e6d7eaefbbd28ab94b... Patch
- https://github.com/NetHack/NetHack/commit/f4a840a48f4bcf11757b3d859e9d53cc9d5ef2... Patch
- https://github.com/NetHack/NetHack/security/advisories/GHSA-3cm7-rgh5-9pq5 Third Party Advisory
- https://nethack.org/security/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-120Classic Buffer Overflow
Timeline
Published19 Dec 2019
Updated4 Nov 2026
First seen13 Mar 2026
Track software like this
Free during beta