{"id":"CVE-2024-5742","aliases":["ALSA-2024:6986","ALSA-2024:9430","AZL-42612","AZL-42619","BELL-CVE-2024-5742","CLSA-2026-1779122764","DEBIAN-CVE-2024-5742","DLA-3831-1","EUVD-2024-47130","GHSA-ffhx-2rrf-9c23","MGASA-2024-0223","OESA-2024-1735","RHSA-2024:6986","RHSA-2024:9430","RLSA-2024:6986","RLSA-2024:9430","UBUNTU-CVE-2024-5742","USN-7064-1","USN-7064-2","openSUSE-SU-2024:0157-1","openSUSE-SU-2024:0157-2","openSUSE-SU-2024:14034-1"],"status":"published","title":"Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00344,"percentile":0.2822,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377","CWE-59"],"published":"2024-06-08T05:57:30.331296Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"nano","fixed_in":["2.9.8-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nano","fixed_in":["5.6.1-6.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nano","fixed_in":["6.4-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nano","fixed_in":["6.0-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nano","fixed_in":["8.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nano","fixed_in":["8.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nano","fixed_in":["5.6.1-5.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nano","fixed_in":["7.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nano","fixed_in":["8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nano","fixed_in":["8.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"nano","fixed_in":["3.2-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"nano","fixed_in":["7.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","fixed_in":["8.0-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"nano","fixed_in":["8.0-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nano","fixed_in":["8.0-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nano","fixed_in":["8.0-1.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano","fixed_in":["0:2.9.8-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano-debuginfo","fixed_in":["0:2.9.8-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano-debugsource","fixed_in":["0:2.9.8-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano","fixed_in":["0:5.6.1-6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano-debuginfo","fixed_in":["0:5.6.1-6.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano-debugsource","fixed_in":["0:5.6.1-6.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nano","fixed_in":["0:2.9.8-3.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"nano","fixed_in":["0:5.6.1-6.el9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nano","fixed_in":["2.2.6-1ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nano","fixed_in":["2.5.3-2ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","fixed_in":["2.9.3-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nano","fixed_in":["4.8-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nano","fixed_in":["6.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nano","fixed_in":["7.2-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"nano","fixed_in":["7.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP6","package":"nano","fixed_in":["7.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"nano","fixed_in":["7.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"nano","fixed_in":["7.2-bp156.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nano","fixed_in":["8.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-6.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0-r0"},{"fixed":"8.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0-r0"},{"fixed":"8.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.1-5.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-1+deb12u1"}]}],"versions":["7.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2-3+deb10u1"}]}],"versions":["3.2-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-1.oe2403"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.8-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.8-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nano-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.8-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.1-6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.1-6.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nano-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.1-6.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.8-3.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.1-6.el9"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-1ubuntu1+esm1"}]}],"versions":["2.2.6-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu2+esm1"}]}],"versions":["2.4.2-1","2.4.2-1ubuntu1","2.4.3-1","2.5.0-1","2.5.1-1","2.5.2-1","2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2ubuntu0.1~esm1"}]}],"versions":["2.8.6-3","2.8.7-1","2.9.0-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1ubuntu1.1"}]}],"versions":["4.3-1","4.5-1","4.7-1","4.7-2","4.8-1","4.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.1"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.1"}]}],"versions":["7.2-1","7.2-2","7.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.3-2ubuntu2+esm1"}]}],"versions":["2.4.2-1","2.4.2-1ubuntu1","2.4.3-1","2.5.0-1","2.5.1-1","2.5.2-1","2.5.3-2","2.5.3-2ubuntu1","2.5.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.3-2ubuntu0.1~esm1"}]}],"versions":["2.8.6-3","2.8.7-1","2.9.0-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.3-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-1ubuntu1.1"}]}],"versions":["4.3-1","4.5-1","4.7-1","4.7-2","4.8-1","4.8-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-1ubuntu0.1"}]}],"versions":["5.6.1-1build1","5.9-1","6.0-1","6.1-1","6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-2ubuntu0.1"}]}],"versions":["7.2-1","7.2-2","7.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-1ubuntu1+esm1"}]}],"versions":["2.2.6-1ubuntu1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2-bp156.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0-2.1"}]}]}],"products":[{"vendor":"gnu","product":"nano"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:6986","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9430","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-5742","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Vendor Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2278574","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00006.html","tags":["x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5742","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ffhx-2rrf-9c23"},{"url":"https://bugzilla.redhat.com/2278574","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-6986.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9430.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-5742","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1779122764.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-5742","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0223.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33297","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VCJGQ6SCOSZGXAPYA7GYUT3M6ZPBLO5V/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1735","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6986.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-5742","tags":["advisory","report"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9430.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6986","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9430","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-5742","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7064-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7064-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VCJGQ6SCOSZGXAPYA7GYUT3M6ZPBLO5V/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1226099","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-5742","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GBANP4TJZOYQBX7QCCMXMTPLJ7XCVTTU/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-5742","title":"Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T08:53:02.256Z","modified":"2026-11-06T14:31:57.271Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T15:28:32.799664Z"}],"euvd":[{"id":"EUVD-2024-47130","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T08:53:02Z","modified":"2026-11-06T14:31:57Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-06T15:05:10.688381Z"}],"ghsa":[{"id":"GHSA-ffhx-2rrf-9c23","title":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an...","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:30:48Z","modified":"2026-10-15T03:33:43Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-59","CWE-377"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-5742","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:23.037Z","modified":"2026-11-06T15:17:03.803Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-06T18:00:49.117518Z"}],"osv":[{"id":"AZL-42612","title":"CVE-2024-5742 affecting package nano for versions less than 6.4-2","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:23Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-05T16:41:19.893001Z"},{"id":"AZL-42619","title":"CVE-2024-5742 affecting package nano for versions less than 6.0-3","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:23Z","modified":"2026-04-21T04:30:40.8703Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"BELL-CVE-2024-5742","status":"published","published":"2024-06-08T05:57:30.331296Z","modified":"2026-08-31T08:34:49.415605Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2024-5742","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:23.037Z","modified":"2026-04-16T04:30:37.705415579Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-5742","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:23.037Z","modified":"2026-11-07T09:47:33.341780985Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2024-1735","title":"nano security update","description":"Nano is now part of Apache CouchDB.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.(CVE-2024-5742)","status":"published","published":"2024-06-21T11:07:12Z","modified":"2026-08-18T01:17:24.573249895Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:6986","title":"Red Hat Security Advisory: nano security update","status":"published","published":"2024-09-25T05:50:36Z","modified":"2026-10-15T10:08:53Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9430","title":"Red Hat Security Advisory: nano security update","status":"published","published":"2024-11-12T18:07:09Z","modified":"2026-10-15T10:09:20Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-5742","description":"A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.","status":"published","published":"2024-06-12T09:15:00Z","modified":"2026-02-04T04:33:36.831774Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"ALSA-2024:6986","title":"Low: nano security update","description":"GNU nano is a small and friendly text editor.\n\nSecurity Fix(es):\n\n* nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVE-2024-5742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-24T00:00:00Z","modified":"2026-10-29T11:02:21.992029241Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9430","title":"Low: nano security update","description":"GNU nano is a small and friendly text editor.  \n\nSecurity Fix(es):  \n\n  * nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVE-2024-5742)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:53.545920544Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2026-1779122764","title":"nano: Fix of CVE-2024-5742","description":"- CVE-2024-5742: emergency_save() applied chmod/chown to a path after\n  the descriptor was closed, allowing a symlink swap to redirect the\n  ownership change to an attacker-controlled file\n- Backport of upstream commit 5e7a3c2e from nano v8.0, adapted to the\n  5.6.1 codebase (write_file signature predates the SPECIAL/NONOTES\n  refactor)","status":"published","published":"2026-05-18T16:46:08Z","modified":"2026-06-01T00:32:33.827950478Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"DLA-3831-1","title":"nano - security update","status":"published","published":"2024-06-17T00:00:00Z","modified":"2026-03-09T01:21:43.665555Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0223","title":"Updated nano packages fix security vulnerability","description":"A vulnerability was found in GNU Nano that allows a possible privilege\nescalation through an insecure temporary file. If Nano is killed while\nediting, a file it saves to an emergency file with the permissions of\nthe running user provides a window of opportunity for attackers to\nescalate privileges through a malicious symlink. (CVE-2024-5742)\n","status":"published","published":"2024-06-15T23:07:50Z","modified":"2026-04-16T04:40:46.147492064Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:0157-1","title":"Security update for nano","description":"This update for nano fixes the following issues:\n\n- CVE-2024-5742: Avoid privilege escalations via symlink attacks on emergency save file (boo#1226099)\n","status":"published","published":"2024-06-11T17:41:12Z","modified":"2026-02-04T02:36:26.791189Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:0157-2","title":"Security update for nano","description":"This update for nano fixes the following issues:\n\n- CVE-2024-5742: Avoid privilege escalations via symlink attacks on emergency save file (boo#1226099)\n","status":"published","published":"2024-06-11T17:41:12Z","modified":"2026-02-04T02:15:16.415323Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:14034-1","title":"nano-8.0-2.1 on GA media","description":"These are all security issues fixed in the nano-8.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:39.433209Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RLSA-2024:6986","title":"Low: nano security update","description":"GNU nano is a small and friendly text editor.\n\nSecurity Fix(es):\n\n* nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVE-2024-5742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-30T14:30:24.512095Z","modified":"2026-02-05T06:15:06.219616Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9430","title":"Low: nano security update","description":"GNU nano is a small and friendly text editor.\n\nSecurity Fix(es):\n\n* nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file (CVE-2024-5742)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:43.608626Z","modified":"2026-02-04T13:15:05.424165Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"USN-7064-1","title":"nano vulnerability","description":"It was discovered that nano allowed a possible privilege escalation\nthrough an insecure temporary file. If nano was killed while editing, the\npermissions granted to the emergency save file could be used by an\nattacker to escalate privileges using a malicious symlink.\n","status":"published","published":"2024-10-15T12:29:19Z","modified":"2026-06-25T13:32:29.204545763Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7064-2","title":"nano vulnerability","description":"USN-7064-1 fixed a vulnerability in nano. This update provides the\ncorresponding update for Ubuntu 14.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that nano allowed a possible privilege escalation\n through an insecure temporary file. If nano was killed while editing, the\n permissions granted to the emergency save file could be used by an\n attacker to escalate privileges using a malicious symlink.\n","status":"published","published":"2024-10-29T11:15:20Z","modified":"2026-06-29T13:51:17.655537515Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}