Source: nnn Version: 5.3-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for nnn. CVE-2026-65609[0]: | nnn is vulnerable to Out-of-Bound write vulnerability. Due to lack | of validation of attacker-controlled length fields deserialized from | a session file, a crafted session file can cause nnn to write data | beyond the bounds of fixed-size global buffers when loaded with the | -s option. An attacker who can place a malicious session file in the | victim's nnn session directory can exploit this to corrupt adjacent | global state. Maintainer of this project was notified about this | vulnerability. It might has been addressed, but the maintainer did | not provide a vulnerable version range. Only version 5.2 was tested | and confirmed as vulnerable. CVE-2026-65610[1]: | nnn stores homelen variable as uchar_t, which can only represent | values in the range 0-255. An attacker who can influence the | victim's execution environment can provide an arbitrary HOME path | with length that is truncated to 0. The expression (homelen - 1) is | promoted to signed int and becomes -1 and producing an out-of-bounds | read and an out-of-bounds write one byte before the path buffer. | Maintainer of this project was notified about this vulnerability. It | might has been addressed, but the maintainer did not provide a | vulnerable version range. Only version 5.2 was tested and confirmed | as vulnerable. CVE-2026-65611[2]: | nnn does not sanitize the path variable. An attacker can create a | directory on a shared filesystem, removable media, or inside an | extracted archive whose name contains a single quote followed by | shell syntax. If the victim enters that directory in nnn and uses | the batch copy or move workflow, the crafted directory name is | embedded into the generated shell command and the injected payload | executes with the privileges of the nnn process. Maintainer of | this project was notified about this vulnerability. It might has | been addressed, but the maintainer did not provide a vulnerable | version range. Only version 5.2 was tested and confirmed as | vulnerable. CVE-2026-65612[3]: | nnn does not sanitize the filename variable. An attacker can place a | file with a crafted name on a shared filesystem, removable media, or | inside an extracted archive whose name contains a single quote | followed by shell syntax. If the victim navigates to that file and | opens it with preview-tabbed, the filename is embedded into | the generated shell command and the injected payload executes with | the privileges of the nnn process. Maintainer of this project was | notified about this vulnerability. It might has been addressed, but | the maintainer did not provide a vulnerable version range. Only | version 5.2 was tested and confirmed as vulnerable. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-65609 https://www.cve.org/CVERecord?id=CVE-2026-65609 [1] https://security-tracker.debian.org/tracker/CVE-2026-65610 https://www.cve.org/CVERecord?id=CVE-2026-65610 [2] https://security-tracker.debian.org/tracker/CVE-2026-65611 https://www.cve.org/CVERecord?id=CVE-2026-65611 [3] https://security-tracker.debian.org/tracker/CVE-2026-65612 https://www.cve.org/CVERecord?id=CVE-2026-65612 Regards, Salvatore
