Name | CVE-2015-5069 |
Description | The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. |
Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
References | DLA-297-1 |
The table below lists information on source packages.
Source Package | Release | Version | Status |
---|---|---|---|
wesnoth-1.10 (PTS) | jessie | 1:1.10.7-2+deb8u1 | fixed |
wesnoth-1.12 (PTS) | stretch | 1:1.12.6-1+deb9u1 | fixed |
The information below is based on the following data on fixed versions.
Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
---|---|---|---|---|---|---|
wesnoth-1.10 | source | wheezy | 1:1.10.3-3+deb7u2 | |||
wesnoth-1.10 | source | jessie | 1:1.10.7-2+deb8u1 | |||
wesnoth-1.10 | source | (unstable) | (unfixed) | |||
wesnoth-1.12 | source | (unstable) | 1:1.12.4-1 | |||
wesnoth-1.13 | unknown | experimental | 1:1.13.1-1 | |||
wesnoth-1.8 | source | squeeze | 1:1.8.5-1+deb6u2 | DLA-297-1 | ||
wesnoth-1.8 | source | (unstable) | (unfixed) |
https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d