Описание
Security update for nano
This update for nano fixes the following issues:
Changes in nano:
-
Update to version 9.1:
- When searching, the viewport is placed snug left where possible.
- The ability to read and write files in old Mac format (a lone carriage return as line ending) was removed.
- The ^T toggle between WhereIs and GotoLine was dropped.
- Fix backups that were missing or had a wrong timestamp when --backup is active.
- On a crash or kill, a .save file is no longer chmodded or chowned to the base file's permissions and owner.
- The history code now creates the ~/.local directory with limited access rights (boo#1263437; the referenced CVE-2026-40556 was rejected upstream).
- M-Ins and M-Del have become rebindable.
-
GNU nano 9.0:
- When the cursor almost goes offscreen to the right, all lines are now scrolled sideways together, by just the amount needed to keep the cursor in view. Use --solosidescroll or 'set solosidescroll' to get back the old, jerky, single-line horizontal scrolling.
- The viewport can be scrolled sideways (in steps of one
tabsize) with M-< and M->. See
man nanorcif M-< and M-> should switch between buffers (as they did earlier). - M-Left, M-Right, M-Up, and M-Down have become rebindable.
- Stopping the recording of a macro immediately after starting it cancels the recording and leaves an existing macro in place.
- Feature toggles no longer break a chain of ^K cuts or M-6 copies, except the M-K cut-from-cursor toggle.
- With --mouse and --indicator, one can click in the scrollbar area to roughly navigate within the buffer.
- CVE-2026-6843: format string vulnerability leads to denial of service (boo#1262643)
- create the ~/.local directory with limited access rights (CVE-2026-6842 boo#1263022, CVE-2026-40556 boo#1263437)
-
GNU nano 8.7.1:
- fix build against glibc-2.43 (boo#1258260)
-
GNU nano 8.7:
- At the Execute prompt, preceding the command with two pipe symbols allows implementing a copy-to-clipboard feature in nanorc on terminals that support OSC 52. See doc/sample.nanorc
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1258260
- SUSE Bug 1262643
- SUSE Bug 1263022
- SUSE Bug 1263437
- SUSE CVE CVE-2026-40556 page
- SUSE CVE CVE-2026-6842 page
- SUSE CVE CVE-2026-6843 page
Описание
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Затронутые продукты
Ссылки
- CVE-2026-40556
- SUSE Bug 1263437
Описание
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Затронутые продукты
Ссылки
- CVE-2026-6842
- SUSE Bug 1263022
Описание
A flaw was found in nano. A local user could exploit a format string vulnerability in the `statusline()` function. By creating a directory with a name containing `printf` specifiers, the application attempts to display this name, leading to a segmentation fault (SEGV). This results in a Denial of Service (DoS) for the `nano` application.
Затронутые продукты
Ссылки
- CVE-2026-6843
- SUSE Bug 1262643