Description
Freeciv versions 3.1.0 through 3.2.5 contain an out-of-bounds read vulnerability in sg_load_player_unit() when processing savegame files with invalid unit activity indices. An attacker can craft a malicious savegame file with an out-of-range activity index that bypasses bounds checking and causes a crash or limited heap memory exposure when loaded.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
freeciv freeciv
Default version status: unaffected
3.1.0 to < 3.2.6affected
References
- https://github.com/freeciv/freeciv/commit/ef0c76c2765fe383140eb1a70dbea1228844152e ↗
- https://github.com/freeciv/freeciv ↗
- https://redmine.freeciv.org/issues/2162 ↗
- https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame3.c#L6108 ↗
- https://github.com/freeciv/freeciv/releases/tag/R3_2_6 ↗
- https://github.com/freeciv/freeciv/blob/R3_2_5/server/savegame/savegame2.c#L4282 ↗
- https://www.vulncheck.com/advisories/freeciv-3.1.0-through-3.2.5-out-of-bounds-read-via-savegame ↗