CVE-2015-5070 | Vulnetix

CVE-2015-5070 PUBLISHED CVSS 3.0999999046325684 LOW

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.

EPSS 1.38% · 71.8th percentile

Risk Scores

CVSS 3.0

3.0999999046325684

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Score

1.38%

71.8th percentile

Affected Products

Vendor	Product	Versions
fedoraproject	fedora	21, 22
n/a	n/a	n/a
wesnoth	battle_for_wesnoth	0, 1.13.0

Timeline

Sep 26, 2017 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 15, 2022 EPSS Score
Sep 6, 2022 EPSS Score
Oct 29, 2022 EPSS Score
Dec 21, 2022 EPSS Score
Feb 13, 2023 EPSS Score
Apr 7, 2023 EPSS Score
May 30, 2023 EPSS Score
Jul 22, 2023 EPSS Score

References

75425 vdb
FEDORA-2015-10964 vendor-advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.html advisory
https://gna.org/bugs/?23504 technical
http://www.openwall.com/lists/oss-security/2015/06/25/12 mailing_list
https://bugzilla.redhat.com/show_bug.cgi?id=1236010 issue
https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59 patch
https://github.com/wesnoth/wesnoth/releases/tag/1.12.4 technical
https://nvd.nist.gov/vuln/detail/CVE-2015-5070 advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.13.1 url

Open in Interactive Console →