CVE-2015-5069

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.

CVSS v3.0 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3.0 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://gna.org/bugs/?23504	Broken Link
https://github.com/wesnoth/wesnoth/releases/tag/1.13.1	Release Notes Third Party Advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.12.3	Release Notes Third Party Advisory
https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d	Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1236010	Issue Tracking Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/75424	Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2015/06/25/12	Mailing List Patch Third Party Advisory VDB Entry
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html	Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.html	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wesnoth:battle_for_wesnoth::::::::
	cpe:2.3:a:wesnoth:battle_for_wesnoth:1.13.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:21:::::::*
	cpe:2.3:o:fedoraproject:fedora:22:::::::*

Information

Published : 2017-09-26 07:29

Updated : 2017-10-10 07:54

NVD link : CVE-2015-5069

Mitre link : CVE-2015-5069

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

wesnoth

battle_for_wesnoth

fedoraproject

fedora

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://gna.org/bugs/?23504", "name": "https://gna.org/bugs/?23504", "tags": ["Broken Link"], "refsource": "MISC"}, {"url": "https://github.com/wesnoth/wesnoth/releases/tag/1.13.1", "name": "https://github.com/wesnoth/wesnoth/releases/tag/1.13.1", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/wesnoth/wesnoth/releases/tag/1.12.3", "name": "https://github.com/wesnoth/wesnoth/releases/tag/1.12.3", "tags": ["Release Notes", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d", "name": "https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1236010", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1236010", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/75424", "name": "75424", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.openwall.com/lists/oss-security/2015/06/25/12", "name": "[oss-security] 20150625 Re: CVE request: Wesnoth authentication information disclosure", "tags": ["Mailing List", "Patch", "Third Party Advisory", "VDB Entry"], "refsource": "MLIST"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html", "name": "FEDORA-2015-10964", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.html", "name": "FEDORA-2015-10973", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2015-5069", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": true, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}}, "publishedDate": "2017-09-26T14:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:wesnoth:battle_for_wesnoth:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.12.2"}, {"cpe23Uri": "cpe:2.3:a:wesnoth:battle_for_wesnoth:1.13.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-10-10T14:54Z"}