Vulnerability in Wesnoth
CVE-2009-0367
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.109 (95.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 95.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.109 · newest: 0.109 · change: 0.000
Affected products
- Wesnoth — versions 1.4, 1.4.1, 1.4.2
Weakness classification (CWE)
References
- launchpad.net/bugs/336396
- packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog
- gna.org/bugs/index.php
- exchange.xforce.ibmcloud.com/vulnerabilities/49058 (vdb-entry)
- www.wesnoth.org/forum/viewtopic.php (Patch, Vendor Advisory)
- packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog
- www.wesnoth.org/forum/viewtopic.php (Patch, Vendor Advisory)
- secunia.com/advisories/34058 (Vendor Advisory, third-party-advisory)
- www.vupen.com/english/advisories/2009/0595 (Patch, vdb-entry, Vendor Advisory)
- launchpad.net/bugs/cve/2009-0367