Difference between revisions of "NetHack 3.6.5"

From NetHackWiki
Jump to navigation Jump to search
m
m (Add noversion and references)
 
(2 intermediate revisions by 2 users not shown)
Line 10: Line 10:
  
 
=== Security ===
 
=== Security ===
 +
{{main|Security}}
  
These security vulnerabilities were fixed:
+
Six major security exploits were fixed. They were all buffer overflows that could be triggered by parsing options in configuration options or the command line.
 
 
* CVE-2020-5209: command line parsing of options starting with -de and -i is subject to a [[wikipedia:buffer overflow|buffer overflow]]<ref>https://nethack.org/security/CVE-2020-5209.html</ref>
 
* CVE-2020-5210: command line -w option parsing is subject to a buffer overflow<ref>https://nethack.org/security/CVE-2020-5210.html</ref>
 
* CVE-2020-5211: [[Options#AUTOCOMPLETE|AUTOCOMPLETE]] configuration file option is subject to a buffer overflow<ref>https://nethack.org/security/CVE-2020-5211.html</ref>
 
* CVE-2020-5212: [[Menucolors|MENUCOLOR]] configuration file option is subject to a buffer overflow<ref>https://nethack.org/security/CVE-2020-5212.html</ref>
 
* CVE-2020-5213: [[Options#SYMBOL|SYMBOL]] configuration file option is subject to a buffer overflow<ref>https://nethack.org/security/CVE-2020-5213.html</ref>
 
* CVE-2020-5214: error recovery after syntax error in configuration file is subject to a buffer overflow<ref>https://nethack.org/security/CVE-2020-5214.html</ref>
 
 
 
These were all reported to the DevTeam by security researcher David Mendenhall.
 
  
 
=== Bug fixes ===
 
=== Bug fixes ===
Line 35: Line 27:
  
 
== References ==
 
== References ==
 +
<references/>
  
 +
{{noversion}}
 
[[Category:History]]
 
[[Category:History]]

Latest revision as of 00:22, 20 January 2021

NetHack 3.6.5 is the 35th public release of NetHack. It was released on 27th January 2020. This release fixes several security exploits that existed in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3 and 3.6.4, as well as some more minor bugs. There were no new gameplay features.[1]

Availability

NetHack 3.6.5 is available from the official NetHack website.

Significant changes

Security

Main article: Security

Six major security exploits were fixed. They were all buffer overflows that could be triggered by parsing options in configuration options or the command line.

Bug fixes

Other bug fixes include:[2]

  • fix accessing mons[-1] when trying to gate in a non-valid demon
  • fix accessing mons[-1] when monster figures out if a tin cures stoning
  • have string_for_opt() return empty_optstr on failure
  • ensure existing callers of string_for_opt() check return value before using it
  • use vsnprintf instead of vsprintf in pline.c where possible
  • Windows: includes a fix from a 3.6.4 post-release update where OPTIONS=map_mode:fit_to_screen could cause a game start failure
  • Windows: users with C-locale unmappable names could get game start failure

References