[Forgot Password]
Login  Register Subscribe

24128

 
 

131573

 
 

111017

 
 

909

 
 

86402

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2015-5069Date: (C)2017-09-27   (M)2018-04-14


The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : 4.3CVSS Score : 4.0
Exploit Score: 2.8Exploit Score: 8.0
Impact Score: 1.4Impact Score: 2.9
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: NETWORKAccess Vector: NETWORK
Attack Complexity: LOWAccess Complexity: LOW
Privileges Required: LOWAuthentication: SINGLE_INSTANCE
User Interaction: NONEConfidentiality: PARTIAL
Scope: UNCHANGEDIntegrity: NONE
Confidentiality: LOWAvailability: NONE
Integrity: NONE 
Availability: NONE 
  
Reference:
BID-75424
FEDORA-2015-10964
FEDORA-2015-10973
http://www.openwall.com/lists/oss-security/2015/06/25/12
https://bugzilla.redhat.com/show_bug.cgi?id=1236010
https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d
https://github.com/wesnoth/wesnoth/releases/tag/1.12.3
https://github.com/wesnoth/wesnoth/releases/tag/1.13.1
https://gna.org/bugs/?23504

CPE    2
cpe:/o:fedoraproject:fedora:21
cpe:/o:fedoraproject:fedora:22
CWE    1
CWE-200
OVAL    2
oval:org.secpod.oval:def:109272
oval:org.secpod.oval:def:109283

© SecPod Technologies