1. Ubuntu Security Notices
  2. USN-7064-1

USN-7064-1: nano vulnerability

Publication date

15 October 2024

Overview

nano could be made to give users administrator privileges.

Releases

Packages

  • nano - small, friendly text editor inspired by Pico

Details

It was discovered that nano allowed a possible privilege escalation
through an insecure temporary file. If nano was killed while editing, the
permissions granted to the emergency save file could be used by an
attacker to escalate privileges using a malicious symlink.

It was discovered that nano allowed a possible privilege escalation
through an insecure temporary file. If nano was killed while editing, the
permissions granted to the emergency save file could be used by an
attacker to escalate privileges using a malicious symlink.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.04 noble nano –  7.2-2ubuntu0.1
22.04 jammy nano –  6.2-1ubuntu0.1
20.04 focal nano –  4.8-1ubuntu1.1
18.04 bionic nano –  2.9.3-2ubuntu0.1~esm1  
16.04 xenial nano –  2.5.3-2ubuntu2+esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›