CVE-2009-0367 The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then u...
HighCVSS 9.3
EPSS 10.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wesnoth | = 1.4 | No fix listed |
| wesnoth | = 1.4.1 | No fix listed |
| wesnoth | = 1.4.2 | No fix listed |
| wesnoth | = 1.4.3 | No fix listed |
| wesnoth | = 1.4.4 | No fix listed |
| wesnoth | = 1.4.5 | No fix listed |
| wesnoth | = 1.4.6 | No fix listed |
| wesnoth | = 1.4.7 | No fix listed |
| wesnoth | = 1.5.0 | No fix listed |
| wesnoth | = 1.5.1 | No fix listed |
| wesnoth | = 1.5.2 | No fix listed |
| wesnoth | = 1.5.3 | No fix listed |
| wesnoth | = 1.5.4 | No fix listed |
| wesnoth | = 1.5.5 | No fix listed |
| wesnoth | = 1.5.6 | No fix listed |
| wesnoth | = 1.5.7 | No fix listed |
| wesnoth | = 1.5.8 | No fix listed |
| wesnoth | = 1.5.9 | No fix listed |
| wesnoth | = 1.5.10 | No fix listed |
References
- launchpad.net
- launchpad.net
- launchpad.net
- packages.debian.org
- packages.debian.org
- 34058 third-party-advisory vendor-advisory
- 34236 third-party-advisory
- DSA-1737 vendor-advisory
- ADV-2009-0595 patch vdb-entry vendor-advisory
- www.wesnoth.org patch vendor-advisory
- www.wesnoth.org patch vendor-advisory
- wesnoth-pythonai-code-execution(49058) vdb-entry
- gna.org