rpm package
opensuse/nano&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/nano&distro=openSUSE%20Tumbleweed
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-40556 | — | < 9.1-1.1 | 9.1-1.1 | Apr 28, 2026 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||
| CVE-2026-6843 | Med | 5.5 | < 9.0-2.1 | 9.0-2.1 | Apr 22, 2026 | A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This resul | |
| CVE-2026-6842 | Low | 2.5 | < 9.0-2.1 | 9.0-2.1 | Apr 22, 2026 | A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unin | |
| CVE-2024-5742 | — | < 8.0-2.1 | 8.0-2.1 | Jun 12, 2024 | A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to e | ||
| CVE-2010-1161 | — | < 2.7.1-1.1 | 2.7.1-1.1 | Apr 16, 2010 | Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files. | ||
| CVE-2010-1160 | — | < 2.7.1-1.1 | 2.7.1-1.1 | Apr 16, 2010 | GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim. |
- CVE-2026-40556Apr 28, 2026affected < 9.1-1.1fixed 9.1-1.1
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
- affected < 9.0-2.1fixed 9.0-2.1
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This resul
- affected < 9.0-2.1fixed 9.0-2.1
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unin
- CVE-2024-5742Jun 12, 2024affected < 8.0-2.1fixed 8.0-2.1
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to e
- CVE-2010-1161Apr 16, 2010affected < 2.7.1-1.1fixed 2.7.1-1.1
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.
- CVE-2010-1160Apr 16, 2010affected < 2.7.1-1.1fixed 2.7.1-1.1
GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.