Vulnerability-Lookup

OPENSUSE-SU-2026:21166-1

Vulnerability from csaf_opensuse - Published: 2026-06-29 08:14 - Updated: 2026-09-17 17:37

Summary

Security update for nano

Severity

Moderate

Notes

Title of the patch: Security update for nano

Description of the patch: This update for nano fixes the following issues: Changes in nano: - Update to version 9.1: * When searching, the viewport is placed snug left where possible. * The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed. * The ^T toggle between WhereIs and GotoLine was dropped. * Fix backups that were missing or had a wrong timestamp when --backup is active. * On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner. * The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream). * M-Ins and M-Del have become rebindable. - GNU nano 9.0: * When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling. * The viewport can be scrolled sideways (in steps of one tabsize) with M-< and M->. See `man nanorc` if M-< and M-> should switch between buffers (as they did earlier). * M-Left, M-Right, M-Up, and M-Down have become rebindable. * Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place. * Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle. * With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer. * CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643) * create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437) - GNU nano 8.7.1: * fix build against glibc-2.43 (boo#1258260) - GNU nano 8.7: * At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc

Patchnames: openSUSE-Leap-16.0-packagehub-361

CVE-2026-40556

Affected products

Recommended 5 products

Product	Version	Remediation
Unresolved product id: openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch	—	Vendor Fix

Threats

Impact moderate

CVE-2026-6842

Affected products

Recommended 5 products, the same list as for CVE-2026-40556

Threats

Impact low

CVE-2026-6843

Affected products

Recommended 5 products, the same list as for CVE-2026-40556

Threats

Impact moderate

References

15 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://bugzilla.suse.com/1258260	self
https://bugzilla.suse.com/1262643	self
https://bugzilla.suse.com/1263022	self
https://bugzilla.suse.com/1263437	self
https://www.suse.com/security/cve/CVE-2026-40556/	self
https://www.suse.com/security/cve/CVE-2026-6842/	self
https://www.suse.com/security/cve/CVE-2026-6843/	self
https://www.suse.com/security/cve/CVE-2026-40556	external
https://bugzilla.suse.com/1263437	external
https://www.suse.com/security/cve/CVE-2026-6842	external
https://bugzilla.suse.com/1263022	external
https://www.suse.com/security/cve/CVE-2026-6843	external
https://bugzilla.suse.com/1262643	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for nano",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for nano fixes the following issues:\n\nChanges in nano:\n\n- Update to version 9.1:\n  * When searching, the viewport is placed snug left where\n    possible.\n  * The ability to read and write files in old Mac format (a lone\n    carriage return as line ending) was removed.\n  * The ^T toggle between WhereIs and GotoLine was dropped.\n  * Fix backups that were missing or had a wrong timestamp when\n    --backup is active.\n  * On a crash or kill, a .save file is no longer chmodded or\n    chowned to the base file\u0027s permissions and owner.\n  * The history code now creates the ~/.local directory with\n    limited access rights (boo#1263437; the referenced\n    CVE-2026-40556 was rejected upstream).\n  * M-Ins and M-Del have become rebindable.\n\n- GNU nano 9.0:\n  * When the cursor almost goes offscreen to the right, all lines\n    are now scrolled sideways together, by just the amount needed\n    to keep the cursor in view.\n    Use --solosidescroll or \u0027set solosidescroll\u0027 to get back the\n    old, jerky, single-line horizontal scrolling.\n  * The viewport can be scrolled sideways (in steps of one\n    tabsize) with M-\u003c and M-\u003e.  See `man nanorc` if M-\u003c and M-\u003e\n    should switch between buffers (as they did earlier).\n  * M-Left, M-Right, M-Up, and M-Down have become rebindable.\n  * Stopping the recording of a macro immediately after starting\n    it cancels the recording and leaves an existing macro in place.\n  * Feature toggles no longer break a chain of ^K cuts or M-6\n    copies, except the M-K cut-from-cursor toggle.\n  * With --mouse and --indicator, one can click in the scrollbar\n    area to roughly navigate within the buffer.\n  * CVE-2026-6843: format string vulnerability leads to denial of\n    service (boo#1262643)\n  * create the ~/.local directory with limited access rights\n    (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)\n\n- GNU nano 8.7.1:\n  * fix build against glibc-2.43 (boo#1258260)\n\n- GNU nano 8.7:\n  * At the Execute prompt, preceding the command with two pipe\n    symbols allows implementing a copy-to-clipboard feature in\n    nanorc on terminals that support OSC 52. See doc/sample.nanorc\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-361",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21166-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1258260",
        "url": "https://bugzilla.suse.com/1258260"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1262643",
        "url": "https://bugzilla.suse.com/1262643"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1263022",
        "url": "https://bugzilla.suse.com/1263022"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1263437",
        "url": "https://bugzilla.suse.com/1263437"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-40556 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-40556/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6842 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6842/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-6843 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-6843/"
      }
    ],
    "title": "Security update for nano",
    "tracking": {
      "current_release_date": "2026-09-17T17:37:07Z",
      "generator": {
        "date": "2026-06-29T08:14:36Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21166-1",
      "initial_release_date": "2026-06-29T08:14:36Z",
      "revision_history": [
        {
          "date": "2026-06-29T08:14:36Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T20:40:11Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T21:42:14Z",
          "number": "3",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-17T17:37:07Z",
          "number": "4",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nano-0:9.1-bp160.1.1.aarch64",
                "product": {
                  "name": "nano-0:9.1-bp160.1.1.aarch64",
                  "product_id": "nano-0:9.1-bp160.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:nano:9.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nano@9.1-bp160.1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nano-lang-0:9.1-bp160.1.1.noarch",
                "product": {
                  "name": "nano-lang-0:9.1-bp160.1.1.noarch",
                  "product_id": "nano-lang-0:9.1-bp160.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nano-lang@9.1-bp160.1.1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nano-0:9.1-bp160.1.1.ppc64le",
                "product": {
                  "name": "nano-0:9.1-bp160.1.1.ppc64le",
                  "product_id": "nano-0:9.1-bp160.1.1.ppc64le",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:nano:9.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nano@9.1-bp160.1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nano-0:9.1-bp160.1.1.s390x",
                "product": {
                  "name": "nano-0:9.1-bp160.1.1.s390x",
                  "product_id": "nano-0:9.1-bp160.1.1.s390x",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:nano:9.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nano@9.1-bp160.1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nano-0:9.1-bp160.1.1.x86_64",
                "product": {
                  "name": "nano-0:9.1-bp160.1.1.x86_64",
                  "product_id": "nano-0:9.1-bp160.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:nano:9.1:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nano@9.1-bp160.1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nano-0:9.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64"
        },
        "product_reference": "nano-0:9.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nano-0:9.1-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le"
        },
        "product_reference": "nano-0:9.1-bp160.1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nano-0:9.1-bp160.1.1.s390x as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x"
        },
        "product_reference": "nano-0:9.1-bp160.1.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nano-0:9.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64"
        },
        "product_reference": "nano-0:9.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nano-lang-0:9.1-bp160.1.1.noarch as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
        },
        "product_reference": "nano-lang-0:9.1-bp160.1.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40556",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-40556"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-40556",
          "url": "https://www.suse.com/security/cve/CVE-2026-40556"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263437 for CVE-2026-40556",
          "url": "https://bugzilla.suse.com/1263437"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-29T08:14:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-40556"
    },
    {
      "cve": "CVE-2026-6842",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6842"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6842",
          "url": "https://www.suse.com/security/cve/CVE-2026-6842"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1263022 for CVE-2026-6842",
          "url": "https://bugzilla.suse.com/1263022"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-29T08:14:36Z",
          "details": "low"
        }
      ],
      "title": "CVE-2026-6842"
    },
    {
      "cve": "CVE-2026-6843",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-6843"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
          "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
          "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-6843",
          "url": "https://www.suse.com/security/cve/CVE-2026-6843"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1262643 for CVE-2026-6843",
          "url": "https://bugzilla.suse.com/1262643"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.ppc64le",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.s390x",
            "openSUSE Leap 16.0:nano-0:9.1-bp160.1.1.x86_64",
            "openSUSE Leap 16.0:nano-lang-0:9.1-bp160.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-29T08:14:36Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-6843"
    }
  ]
}

CVE-2026-40556 (GCVE-0-2026-40556)

Vulnerability from cvelistv5 – Published: 2026-04-28 13:54 – Updated: 2026-04-29 07:17

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Replaced by CVE-2026-6842

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-04-29T07:17:27.349Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ],
      "replacedBy": [
        "CVE-2026-6842"
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2026-40556",
    "datePublished": "2026-04-28T13:54:11.918Z",
    "dateRejected": "2026-04-29T07:15:52.820Z",
    "dateReserved": "2026-04-14T09:44:32.553Z",
    "dateUpdated": "2026-04-29T07:17:27.349Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6842 (GCVE-0-2026-6842)

Vulnerability from cvelistv5 – Published: 2026-04-22 07:34 – Updated: 2026-09-01 12:07

Title

Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions

Summary

A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.

Severity

2.5 (Low)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 13:07 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-6842	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2460018	issue-trackingx_refsource_REDHAT

Impacted products

7 products

Vendor	Product	Version
		Affected: 2.9.1 , < 9.0 (semver)
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-04-13 00:00

Credits

Red Hat would like to thank Michał Majchrowicz, Marcin Wyczechowski (AFINE Team) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6842",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:07:50.621296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:07:57.497Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://git.savannah.gnu.org/git/nano.git",
          "defaultStatus": "unaffected",
          "packageName": "nano",
          "versions": [
            {
              "lessThan": "9.0",
              "status": "affected",
              "version": "2.9.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Micha\u0142 Majchrowicz, Marcin Wyczechowski (AFINE Team) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Low"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.5,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T12:07:35.563Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-6842"
        },
        {
          "name": "RHBZ#2460018",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460018"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-13T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-13T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions",
      "workarounds": [
        {
          "lang": "en",
          "value": "Ensure that the system\u0027s umask is configured to a secure value, such as `0022` or `0077`, to prevent the creation of world-writable directories. This can be set system-wide in `/etc/profile` or `/etc/bashrc`, or for individual users in their `~/.bashrc` or `~/.profile`. A secure umask will ensure that newly created directories, including `~/.local` by `nano`, have appropriate permissions."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-732: Incorrect Permission Assignment for Critical Resource"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-6842",
    "datePublished": "2026-04-22T07:34:26.360Z",
    "dateReserved": "2026-04-22T07:20:17.989Z",
    "dateUpdated": "2026-09-01T12:07:35.563Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6843 (GCVE-0-2026-6843)

Vulnerability from cvelistv5 – Published: 2026-04-22 08:30 – Updated: 2026-09-01 11:45

Title

Nano: nano: format string vulnerability leads to denial of service

Summary

A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 12:04 UTC

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-6843	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2460017	issue-trackingx_refsource_REDHAT

Impacted products

6 products

Vendor	Product	Version
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4

Date Public

2026-04-13 00:00

Credits

Red Hat would like to thank Michał Majchrowicz, Marcin Wyczechowski (AFINE Team) for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6843",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T12:04:45.914675Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T12:04:58.643Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "nano",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Micha\u0142 Majchrowicz, Marcin Wyczechowski (AFINE Team) for reporting this issue."
        }
      ],
      "datePublic": "2026-04-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T11:45:08.190Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-6843"
        },
        {
          "name": "RHBZ#2460017",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460017"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-13T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-04-13T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Nano: nano: format string vulnerability leads to denial of service",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-134: Use of Externally-Controlled Format String"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-6843",
    "datePublished": "2026-04-22T08:30:04.572Z",
    "dateReserved": "2026-04-22T07:23:19.148Z",
    "dateUpdated": "2026-09-01T11:45:08.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:21166-1

CVE-2026-40556 (GCVE-0-2026-40556)

CVE-2026-6842 (GCVE-0-2026-6842)

CVE-2026-6843 (GCVE-0-2026-6843)

Tags

Sightings

Nomenclature

Related by attack behaviour