PT-2020-14107 · Chocolate Doom Team+2 · Chocolate Doom+2

Michał Dardas · Published 2020-06-22 · Updated 2023-01-27 · CVE-2020-14983

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chocolate Doom version 3.0.0 Crispy Doom version 5.8.0

Description The issue arises from the server's failure to validate the user-controlled num players value, resulting in a buffer overflow. This allows a malicious user to overwrite the server's stack.

Recommendations For Chocolate Doom version 3.0.0, update to a version that includes input validation for the num players value to prevent buffer overflows. For Crispy Doom version 5.8.0, apply a patch or update that properly validates user-controlled input to prevent stack overwrites.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-14983

MGASA-2020-0302

OPENSUSE-SU-2020:0928-1

OPENSUSE-SU-2020:0939-1

OPENSUSE-SU-2020:0947-1

OPENSUSE-SU-2020_0928-1

OPENSUSE-SU-2020_0939-1

OPENSUSE-SU-2024:10680-1

Affected Products

Chocolate Doom

Crispy Doom

Suse

References · 23

• 🔥 https://github.com/chocolate-doom/chocolate-doom/issues/1293 · Exploit
• https://ubuntu.com/security/CVE-2020-14983 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-14983 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0939-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-14983 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0302 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14983 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0947-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00012.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0302.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0928-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14983 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00002.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-14983 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00007.html · Vendor Advisory