PT-2018-15202 · Battle For Wesnoth · The Battle For Wesnoth

Publicado 2018-07-23 · Atualizado 2024-06-15 · CVE-2018-1999023

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Battle for Wesnoth Project versions 1.7.0 through 1.14.3

Description The issue concerns a Code Injection vulnerability in the Lua scripting engine, which can lead to code execution outside the sandbox. This can be exploited by loading specially-crafted saved games, networked games, replays, and player content.

Recommendations For versions 1.7.0 through 1.14.3, consider disabling the Lua scripting engine as a temporary workaround until a patch is available. Restrict access to loading saved games, networked games, replays, and player content from untrusted sources to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

AZL-38656

CVE-2018-1999023

MGASA-2018-0325

OPENSUSE-SU-2024:11509-1

Produtos afetados

The Battle For Wesnoth

Referências · 16

• https://github.com/wesnoth/wesnoth/blob/1.14.4/changelog.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999023 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=23338 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1999023 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1999023 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-1999023 · Nota
• http://openwall.com/lists/oss-security/2018/07/22/1 · Nota
• https://osv.dev/vulnerability/AZL-38656 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2018-0325 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0325.html · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1999023 · Aviso do Fabricante
• https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380 · Correção
• https://ubuntu.com/security/CVE-2018-1999023 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-1999023 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:11509-1 · Aviso do Fabricante