6 results · Feed
-
Medium 6.8
Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.
A flaw was found in GNU nano's multi-buffer error message handling. When a user opens multiple files at startup and one triggers an ALERT-level error, a specially crafted filename containing printf format specifiers can be reinterpreted. This format string vu…
-
Medium 5.5
Nano: nano: format string vulnerability leads to denial of service
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fau…
-
Low 2.5
Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, whi…
-
Medium 6.7
Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportuni…
-
Unscored —
GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation…
-
Unscored —
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-a…