CVE-2007-3917

Published: 11 October 2007

The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp. NOTE: this issue affects both clients and servers.

Priority

Status

Package	Release	Status
wesnoth Launchpad, Ubuntu, Debian	dapper	Released (1.1+reverted+to+1.0.2-0ubuntu1.2)
	edgy	Released (1.1.8-1ubuntu0.2)
	feisty	Released (1.2.3-0ubuntu1.1)
	gutsy	Released (1.2.6-1ubuntu2.1)
	upstream	Released (1.2.7)

References

https://www.cve.org/CVERecord?id=CVE-2007-3917
NVD
Launchpad
Debian

Bugs

https://bugs.launchpad.net/ubuntu/gutsy/+source/wesnoth/+bug/173881

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›