CVE-2020-14983

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
chocolate-doomchocolate_doom
3.0.0
chocolate-doomcrispy_doom
5.8.0
opensuseleap
15.1
opensuseleap
15.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
chocolate-doom
bullseye
3.0.1-1
fixed
buster
no-dsa
bookworm
3.0.1+really3.0.0+git1471-1
fixed
sid
3.1.0-1
fixed
trixie
3.1.0-1
fixed
crispy-doom
bullseye
5.10.0-1
fixed
buster
no-dsa
bookworm
5.12.0-1
fixed
sid
7.0-1
fixed
trixie
7.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chocolate-doom
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
needs-triage
eoan
ignored
bionic
needs-triage
xenial
needs-triage
trusty
dne
crispy-doom
noble
not-affected
mantic
not-affected
lunar
not-affected
kinetic
not-affected
jammy
not-affected
impish
not-affected
hirsute
not-affected
groovy
not-affected
focal
needs-triage
eoan
ignored
bionic
dne
xenial
dne
trusty
dne