CVE-2020-14983

Published: Jun 22, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

Affected (5)

Products: Chocolate Doom: Chocolate Doom, Crispy Doom · Opensuse: Backports, Leap

2 products

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Chocolate Doom Chocolate Doom	Version 3.0.0
Chocolate Doom Crispy Doom	Version 5.8.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports	Version sle-15 sp1
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.