CVE-2020-14983

EUVD-2020-7113
The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
chocolate-doomchocolate_doom
3.0.0
chocolate-doomcrispy_doom
5.8.0
opensuseleap
15.1
opensuseleap
15.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chocolate-doom
bookworm
3.0.1+really3.0.0+git1471-1
fixed
bullseye
3.0.1-1
fixed
buster
no-dsa
sid
3.1.0-1
fixed
trixie
3.1.0-1
fixed
crispy-doom
bookworm
5.12.0-1
fixed
bullseye
5.10.0-1
fixed
buster
no-dsa
sid
7.0-1
fixed
trixie
7.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chocolate-doom
bionic
needs-triage
eoan
ignored
focal
needs-triage
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
needs-triage
crispy-doom
bionic
dne
eoan
ignored
focal
needs-triage
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
kinetic
not-affected
lunar
not-affected
mantic
not-affected
noble
not-affected
trusty
dne
xenial
dne