Summary
The remote host is missing an update to wesnoth
announced via advisory DSA 1386-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201386-1
Insight
A problem has been discovered in the processing of chat messages.
Overly long messages are truncated by the server to a fixed length, without paying attention to the multibyte characters. This leads to invalid UTF-8 on clients and causes an uncaught exception. Note that both wesnoth and the wesnoth server are affected.
For the old stable distribution (sarge) this problem has been fixed in version 0.9.0-6 and in version 1.2.7-1~bpo31+1 of sarge-backports.
For the stable distribution (etch) this problem has been fixed in version 1.2-2 and in version 1.2.7-1~bpo40+1 of etch-backports.
For the unstable distribution (sid) this problem has been fixed in version 1.2.7-1.
Packages for the oldstable mips architecture will be added to the archive later.
We recommend that you upgrade your wesnoth packages.
Severity
Classification
-
CVE CVE-2007-3917 -
CVSS Base Score: 7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C
Related Vulnerabilities
- Debian Security Advisory DSA 1070-1 (kernel-source-2.4.19,kernel-image-sparc-2.4,kernel-patch-2.4.19-mips)
- Debian Security Advisory DSA 016-1 (wu-ftpd)
- Debian Security Advisory DSA 070-1 (netkit-telnet)
- Debian Security Advisory DSA 106-1 (rsync)
- Debian Security Advisory DSA 1018-2 (kernel-source-2.4.27)