3906247c35
The NetHack DevTeam is announcing the release of NetHack 3.6.5 on January 27,
2020
NetHack 3.6.5 is the official release of NetHack that follows NetHack 3.6.4.
This release primarily corrects security issues present in NetHack versions
3.6.0, 3.6.1, 3.6.2, 3.6.3 and 3.6.4.
CVE-2020-5214 Error recovery after syntax error in configuration file is
subject to a buffer overflow
CVE-2020-5213 SYMBOL configuration file option is subject to a buffer overflow
CVE-2020-5212 MENUCOLOR configuration file option is subject to a buffer
overflow
CVE-2020-5211 AUTOCOMPLETE configuration file option is subject to a buffer
overflow
CVE-2020-5210 NetHack command line -w option parsing is subject to a buffer
overflow
CVE-2020-5209 Command line parsing of options starting with -de and -i is
subject to a buffer overflow
CVE-2019-19905 Privilege escalation/remote code execution/crash in
configuration parsing
You are encouraged to update to NetHack 3.6.5 as soon as possible.
Here's a brief synopsis of the handful of bug fixes included in NetHack 3.6.5:
fix accessing mons[-1] when trying to gate in a non-valid demon
fix accessing mons[-1] when monster figures out if a tin cures stoning
have string_for_opt() return empty_optstr on failure
ensure existing callers of string_for_opt() check return value
before using it
fix potential buffer overflow in add_menu_coloring()
fix potential buffer overflow in sym_val()
fix potential buffer overflow in pline(), raw_printf(), and
config_error_add()
fix potential buffer overflow in choose_windows()
use vsnprintf instead of vsprintf in pline.c where possible
Windows: includes a fix from a 3.6.4 post-release update where
OPTIONS=map_mode:fit_to_screen could cause a game start failure
Windows: users with C-locale unmappable names could get game start failure
All of the fixes have been incrementally published on the public Git
repository for the game. A more complete list can be found in the game's
sources in doc/fixes36.5. As usual, a warning that some entries in that
file may also be "spoilers".
Existing saved games and bones files from 3.6.0 through to 3.6.4 should
work with 3.6.5, assuming that the same build configuration options were
used.
|
||
|---|---|---|
| .. | ||
| patches | ||
| DESCR | ||
| distinfo | ||
| Makefile | ||
| Makefile.common | ||
| PLIST | ||