CVE-2020-14983

Summary

CVE	CVE-2020-14983
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-06-22 20:15:00 UTC
Updated	2023-01-27 16:04:00 UTC
Description	The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

Risk And Classification

Problem Types: CWE-120

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Chocolate-doom	Chocolate Doom	3.0.0	-	All	All
Application	Chocolate-doom	Chocolate Doom	3.0.0	-	All	All
Application	Chocolate-doom	Crispy Doom	5.8.0	All	All	All
Application	Chocolate-doom	Crispy Doom	5.8.0	All	All	All
Operating System	Opensuse	Backports	sle-15	sp1	All	All
Operating System	Opensuse	Leap	15.1	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All

References

Reference	Source	Link	Tags
Missing server-side num_players validation leading to buffer overflow · Issue #1293 · chocolate-doom/chocolate-doom · GitHub	MISC	github.com	Exploit, Patch, Third Party Advisory
[security-announce] openSUSE-SU-2020:0947-1: important: Security update	SUSE	lists.opensuse.org
[security-announce] openSUSE-SU-2020:0928-1: important: Security update	SUSE	lists.opensuse.org
[security-announce] openSUSE-SU-2020:0939-1: important: Security update	SUSE	lists.opensuse.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

690376 Free Berkeley Software Distribution (FreeBSD) Security Update for chocolate-doom (35aef72c-5c8e-11eb-8309-4ccc6adda413)