---

CVE-2020-5254

NetHack: NetHack hilite_status parsing privilege escalation

Severity: High
Affected versions: 3.6.1 through 3.6.5
First Patched Version: 3.6.6

Basic Information:
Some out-of-bound values for the hilite_status option can be exploited.

This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files.

Users are encouraged to upgrade as soon as possible.

Additional information related to this advisory, if any, will be made available at https://nethack.org/security.

---

Timeline:
08-Mar-2020 Fixed version 3.6.6 released.
03-Mar-2020 Bug reported.

---

Acknowledgements:
The NetHack Development Team gratefully acknowledges security researcher David Mendenhall for discovering this issue and for responsibly reporting it.

---

Revision History:
08-Mar-2020 Initial Version.