PT-2010-5333 · Openttd · Openttd

Remko Bijker + 1 · Published 2010-11-17 · Updated 2024-06-15 · CVE-2010-4168

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTTD versions 1.0.x through 1.0.4

Description The issue concerns multiple use-after-free vulnerabilities. These vulnerabilities allow remote attackers to cause a denial of service by abruptly disconnecting during transmission of the map from the server, related to network/network server.cpp, or by forcing a disconnection during the join process, related to network/network.cpp. This can result in an invalid write and daemon crash, or an invalid read and daemon or application crash.

Recommendations For OpenTTD versions 1.0.x through 1.0.4, update to version 1.0.5 or later to resolve the issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2010-4168

OPENSUSE-SU-2024:10563-1

Affected Products

Openttd

References · 20

• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052193.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10563-1 · Vendor Advisory
• http://security.openttd.org/en/patch/28.patch · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052187.html · Vendor Advisory
• http://security.openttd.org/en/CVE-2010-4168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4168 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4168 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-4168 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4168 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2985 · Vendor Advisory
• http://marc.info/?l=oss-security&m=128975491407670&w=2 · Note
• https://suse.com/security/cve/CVE-2012-0049 · Note
• http://securityfocus.com/bid/44844 · Note
• https://suse.com/security/cve/CVE-2013-6411 · Note
• http://secunia.com/advisories/42578 · Note