A vulnerability in Freeciv may allow a remote attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| games-strategy/freeciv | * | < 2.2.1 | >= 2.2.1 |
Freeciv is an open-source empire building strategy game.
The Lua component of Freeciv does not restrict which modules may be loaded by scenario scripts.
A remote attacker could entice a user to open a specially crafted scenario file, possibly resulting in execution of arbitrary code or reading of arbitrary files with the privileges of the process.
There is no known workaround at this time.
All Freeciv users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=games-strategy/freeciv-2.2.1"
NOTE: This is a legacy GLSA. Updates for all affected architectures are available since July 26, 2010. It is likely that your system is already no longer affected by this issue.
A memory allocation bug in Freeciv allows a remote attacker to perform a Denial of Service attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| games-strategy/freeciv | * | < 2.0.8 | >= 2.0.8 |
Freeciv is an open source turn-based multiplayer strategy game, similar to the famous Civilization series.
Luigi Auriemma discovered that Freeciv could be tricked into the allocation of enormous chunks of memory when trying to uncompress malformed data packages, possibly leading to an out of memory condition which causes Freeciv to crash or freeze.
A remote attacker could exploit this issue to cause a Denial of Service by sending specially crafted data packages to the Freeciv game server.
Play solo games or restrict your multiplayer games to trusted parties.
All Freeciv users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=games-strategy/freeciv-2.0.8"