CVE-2019-10648

Name	CVE-2019-10648
Description	Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	926088

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
robocode (PTS)	bookworm	1.9.3.9-3	fixed
	trixie	1.9.3.9-4	fixed
	forky, sid	1.9.3.9-5	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
robocode	source	jessie	(unfixed)	end-of-life
robocode	source	(unstable)	1.9.3.3-2	low		926088

Notes

[stretch] - robocode <no-dsa> (Minor issue)
[jessie] - robocode <end-of-life> (games are not supported)
https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f
https://sourceforge.net/p/robocode/bugs/406/