Information Exposure Affecting htop package, versions <0.8.1-2


Severity

Recommended
low

Based on Debian security rating.

Threat Intelligence

EPSS
0.04% (5th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN11-HTOP-521426
  • published14 Nov 2008
  • disclosed14 Nov 2008

Introduced: 14 Nov 2008

CVE-2008-5076  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade Debian:11 htop to version 0.8.1-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream htop package and not the htop package as distributed by Debian. See How to fix? for Debian:11 relevant fixed versions and status.

htop 0.7 writes process names to a terminal without sanitizing non-printable characters, which might allow local users to hide processes, modify arbitrary files, or have unspecified other impact via a process name with "crazy control strings."

CVSS Scores

version 3.1