The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.

The (1) filesystem::getwmllocation function in filesystem.cpp and (2) islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.

Quoting from http://www.openwall.com/lists/oss-security/2015/06/25/2 "Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function (filesystem::getwmllocation()) to resolve file paths so that only content from the user's data directory can be read.

However, the function did not explicitly disallow files with the .pbl extension. The contents of these files could thus be stored in saved game files or even transmitted directly to other users in a networked game. Among the information that's compromised is a user-defined passphrase used to authenticate uploads to the game's content server.

This issue was found by Toom Lõhmus, then verified and fixed by Ignacio R. Morelle."

There have been two patches, [3] and [4]. Patch [3] did only take lowercase extensions into account and was incomplete. Patch [3] is CVE-2015-5069. Patch [4] is an additional patch, fixing the lowercase problem. Patch [4] is CVE-2015-5070.

[1] http://www.openwall.com/lists/oss-security/2015/06/25/2 [2] https://gna.org/bugs/?23504 (currently restricted)

Patches:

Incomplete fix as it only handles lowercase extensions. CVE-2015-5069 [3] https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d

Complete fix, CVE-2015-5070 [4] https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59

Quoting from http://www.openwall.com/lists/oss-security/2015/06/25/2 "Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function (filesystem::getwmllocation()) to resolve file paths so that only content from the user's data directory can be read.

However, the function did not explicitly disallow files with the .pbl extension. The contents of these files could thus be stored in saved game files or even transmitted directly to other users in a networked game. Among the information that's compromised is a user-defined passphrase used to authenticate uploads to the game's content server.

This issue was found by Toom Lõhmus, then verified and fixed by Ignacio R. Morelle."

There have been two patches, [3] and [4]. Patch [3] did only take lowercase extensions into account and was incomplete. Patch [3] is CVE-2015-5069. Patch [4] is an additional patch, fixing the lowercase problem. Patch [4] is CVE-2015-5070.

[1] http://www.openwall.com/lists/oss-security/2015/06/25/2 [2] https://gna.org/bugs/?23504 (currently restricted)

Patches:

Incomplete fix as it only handles lowercase extensions. CVE-2015-5069 [3] https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d

Complete fix, CVE-2015-5070 [4] https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

The readgamemap function in src/terraintranslation.cpp in Wesnoth before r32987 allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a map with a large (1) width or (2) height.

The uncompressbuffer function in src/server/simplewml.cpp in Wesnoth before r33069 allows remote attackers to cause a denial of service via a large compressed WML document.

The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.

Unspecified vulnerability in Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows attackers to cause a denial of service (hang) via a "faulty add-on" and possibly execute other commands via unknown vectors related to the turncmd option.

Directory traversal vulnerability in the WML engine preprocessor for Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows remote attackers to read arbitrary files via ".." sequences in unknown vectors.

Description of problem:

From Novell bugzilla (see URL):

A malicious user could send a long chat message with multibyte characters, the server would truncate the message on a fixed length, without paying attention to the multibyte characters. This led to invalid utf-8 on the client and an uncaught exception was thrown. Note both wesnoth and the wesnoth server are affected.

Additional information:

I am aware of no further details, nor the fix.