CVE-2007-3917 The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an....
HighCVSS 7.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wesnoth | = 1.2 | No fix listed |
| wesnoth | = 1.2.1 | No fix listed |
| wesnoth | = 1.2.2 | No fix listed |
| wesnoth | = 1.2.3 | No fix listed |
| wesnoth | = 1.2.4 | No fix listed |
| wesnoth | = 1.2.5 | No fix listed |
| wesnoth | = 1.2.6 | No fix listed |
| wesnoth | = 1.3.1 | No fix listed |
| wesnoth | = 1.3.2 | No fix listed |
| wesnoth | = 1.3.3 | No fix listed |
| wesnoth | = 1.3.4 | No fix listed |
| wesnoth | = 1.3.5 | No fix listed |
| wesnoth | = 1.3.6 | No fix listed |
| wesnoth | = 1.3.7 | No fix listed |
| wesnoth | = 1.3.8 | No fix listed |
References
- 41711 vdb-entry
- 27137 third-party-advisory vendor-advisory
- 27218 third-party-advisory vendor-advisory
- 27241 third-party-advisory vendor-advisory
- svn.gna.org
- DSA-1386 vendor-advisory
- 25995 vdb-entry
- ADV-2007-3449 vdb-entry vendor-advisory
- www.wesnoth.org
- www.wesnoth.org
- bugzilla.redhat.com
- wesnoth-utf8-dos(37047) vdb-entry
- FEDORA-2007-2496 vendor-advisory