7.8

CVE-2007-3917

The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.

Data is provided by the National Vulnerability Database (NVD)
Wesnoth ≫ Wesnoth Version1.2
Wesnoth ≫ Wesnoth Version1.2.1
Wesnoth ≫ Wesnoth Version1.2.2
Wesnoth ≫ Wesnoth Version1.2.3
Wesnoth ≫ Wesnoth Version1.2.4
Wesnoth ≫ Wesnoth Version1.2.5
Wesnoth ≫ Wesnoth Version1.2.6
Wesnoth ≫ Wesnoth Version1.3.1
Wesnoth ≫ Wesnoth Version1.3.2
Wesnoth ≫ Wesnoth Version1.3.3
Wesnoth ≫ Wesnoth Version1.3.4
Wesnoth ≫ Wesnoth Version1.3.5
Wesnoth ≫ Wesnoth Version1.3.6
Wesnoth ≫ Wesnoth Version1.3.7
Wesnoth ≫ Wesnoth Version1.3.8
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 2.47% 0.838
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 10 6.9
AV:N/AC:L/Au:N/C:N/I:N/A:C
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.