PT-2015-4911 · Wesnoth+1 · Battle For Wesnoth+1

Ignacio R. Morelle · Published 2015-04-10 · Updated 2024-06-15 · CVE-2015-0844

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Battle for Wesnoth versions 1.7.x through 1.11.x Battle for Wesnoth versions 1.12.x prior to 1.12.2

Description The issue allows remote attackers to read arbitrary files through a crafted campaign or map file. This is made possible by the WML/Lua API in the affected software.

Recommendations For versions 1.7.x through 1.11.x, update to a version outside of this range to mitigate the risk. For versions 1.12.x prior to 1.12.2, update to version 1.12.2 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2015-1711

CVE-2015-0844

DLA-202-1

DSA-3218-1

MGASA-2015-0154

OPENSUSE-SU-2024:10261-1

Affected Products

Alt Linux

Battle For Wesnoth

References · 26

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5069 · Security Note
• http://forums.wesnoth.org/viewtopic.php?t=41870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0844 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0154 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155031.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0844 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3218-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0844 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0844 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10261-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2015-1711 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155968.html · Vendor Advisory
• http://debian.org/security/2015/dsa-3218 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3218-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5070 · Security Note