PT-2009-3026 · Battle For Wesnoth · Wesnoth

Daniel Franke · Publicado 2009-03-12 · Atualizado 2009-03-21 · CVE-2009-0366

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Wesnoth versions prior to r33069

Description The issue allows remote attackers to cause a denial of service via a large compressed WML document. This is due to a problem in the uncompress buffer function in src/server/simple wml.cpp.

Recommendations For versions prior to r33069, update to a version after r33069 to resolve the issue. As a temporary workaround, consider restricting the size of compressed WML documents to prevent denial of service attacks.

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2009-0366

DSA-1737-1

Produtos afetados

Wesnoth

Referências · 14

• http://secunia.com/advisories/34253 · Nota
• http://debian.org/security/2009/dsa-1737 · Aviso do Fabricante
• http://launchpad.net/bugs/335089 · Nota
• https://gna.org/bugs/index.php?13037 · Nota
• http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&r1=32990&r2=33069 · Nota
• http://securityfocus.com/bid/34085 · Nota
• http://launchpad.net/bugs/cve/2009-0366 · Nota
• http://osvdb.org/52672 · Nota
• http://svn.gna.org/viewcvs/wesnoth/trunk/src/server/simple_wml.cpp?rev=33069&view=log · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0366 · Nota de Segurança
• http://secunia.com/advisories/34236 · Nota
• http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog · Nota
• http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog · Nota
• http://launchpad.net/bugs/336396 · Nota