PT-2010-4025 · Freeciv · Freeciv

Moritz Muehlenhoff · Published 2010-07-07 · Updated 2021-06-30 · CVE-2010-2445

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions freeciv versions 2.2 through 2.2.1 and versions 2.3 through 2.3.0, but not including 2.3.0

Description The issue allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality. This is related to various Lua modules or functions, including os, io, package, dofile, loadfile, loadlib, module, and require.

Recommendations For freeciv versions 2.2 through 2.2.1, update to version 2.2.1 or later. For freeciv versions 2.3 through 2.3.0, but not including 2.3.0, update to version 2.3.0 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2010-2445

Affected Products

Freeciv

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2445 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:205 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2445 · Security Note
• https://ubuntu.com/security/CVE-2010-2445 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-2445 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-2445 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2445 · Vendor Advisory
• http://gna.org/bugs/?15624 · Patch
• http://openwall.com/lists/oss-security/2010/06/24/5 · Note
• http://packetstormsecurity.com/files/163311/Android-2.0-FreeCIV-Arbitrary-Code-Execution.html · Note
• http://openwall.com/lists/oss-security/2010/06/09/4 · Note
• http://osvdb.org/65192 · Note