[ GLSA 200604-05 ] Doomsday: Format string vulnerability

[GLSA]

Gentoo Linux Security Advisory

Title: Doomsday: Format string vulnerability (GLSA 200604-05)
Severity: high
Exploitable: remote
Date: April 06, 2006
Updated: June 15, 2006
Bug(s): #128690
ID: 200604-05

Synopsis

Format string vulnerabilities in Doomsday may lead to the execution of arbitrary code.

Background

Doomsday is a modern gaming engine for popular ID games like Doom, Heretic and Hexen.

Affected Packages

Package: games-fps/doomsday
Vulnerable: <= 1.9.0_beta4
Unaffected: >= 1.9.0_beta4
Architectures: All supported architectures


Description

Luigi Auriemma discovered that Doomsday incorrectly implements formatted printing.

Impact

A remote attacker could exploit these vulnerabilities to execute arbitrary code with the rights of the user running the Doomsday server or client by sending specially crafted strings.

Workaround

There is no known workaround at this time.

Resolution

All Doomsday users should upgrade to the latest version: