CVE-2020-15007

NameCVE-2020-15007
DescriptionA buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rbdoom3bfg (PTS)stretch1.1.0~preview3+dfsg+git20160807-2vulnerable
buster1.2.0+dfsg~git20181013-1vulnerable
bullseye, sid1.2.0+dfsg~git20200619-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rbdoom3bfgsource(unstable)(unfixed)unimportant

Notes

https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
Problematic code not built

Search for package or bug name: Reporting problems