Bug 897942 (CVE-2023-24809)

Summary:	games-roguelike/nethack: buffer overflow via illegal input
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	CONFIRMED ---
Severity:	minor	CC:	games
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch
Whiteboard:	B3 [ebuild]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2023-02-26 17:54:11 UTC

CVE-2023-24809:

NetHack is a single player dungeon exploration game. Starting with version 3.6.2 and prior to version 3.6.7, illegal input to the "C" (call) command can cause a buffer overflow and crash the NetHack process. This vulnerability may be a security issue for systems that have NetHack installed suid/sgid and for shared systems. For all systems, it may result in a process crash. This issue is resolved in NetHack 3.6.7. There are no known workarounds.

Please bump to 3.6.7.