PT-2010-4025 · Freeciv · Freeciv

Moritz Muehlenhoff · Publicado 2010-07-07 · Atualizado 2021-06-30 · CVE-2010-2445

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions freeciv versions 2.2 through 2.2.1 and versions 2.3 through 2.3.0, but not including 2.3.0

Description The issue allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality. This is related to various Lua modules or functions, including os, io, package, dofile, loadfile, loadlib, module, and require.

Recommendations For freeciv versions 2.2 through 2.2.1, update to version 2.2.1 or later. For freeciv versions 2.3 through 2.3.0, but not including 2.3.0, update to version 2.3.0 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2010-2445

Produtos afetados

Freeciv

Referências · 13

• http://openwall.com/lists/oss-security/2010/06/24/5 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2445 · Aviso do Fabricante
• http://packetstormsecurity.com/files/163311/Android-2.0-FreeCIV-Arbitrary-Code-Execution.html · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2010:205 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/06/09/4 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-2445 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2445 · Nota de Segurança
• https://ubuntu.com/security/CVE-2010-2445 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-2445 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2010-2445 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2010-2445 · Aviso do Fabricante
• http://gna.org/bugs/?15624 · Correção
• http://osvdb.org/65192 · Nota