Bug#1031869: nethack: CVE-2023-24809

[Moritz Mühlenhoff]

Source: nethack
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for nethack.

CVE-2023-24809[0]:
| NetHack is a single player dungeon exploration game. Starting with
| version 3.6.2 and prior to version 3.6.7, illegal input to the "C"
| (call) command can cause a buffer overflow and crash the NetHack
| process. This vulnerability may be a security issue for systems that
| have NetHack installed suid/sgid and for shared systems. For all
| systems, it may result in a process crash. This issue is resolved in
| NetHack 3.6.7. There are no known workarounds.

https://github.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w
https://github.com/nodejs/undici/commit/f2324e549943f0b0937b09fb1c0c16cc7c93abdf (v5.19.1)
		

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-24809
    https://www.cve.org/CVERecord?id=CVE-2023-24809

Please adjust the affected versions in the BTS as needed.