CVE-2006-1075
Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.84%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Format string vulnerability in the visualization function in Jason Boettcher Liero Xtreme 0.62b and earlier allows remote attackers to execute arbitrary code via format string specifiers in (1) a nickname, (2) a dedicated server name, or (3) a mapname in a level (aka .lxl) file.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.84% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- jason boettcher/liero xtreme
- Source
- cve@mitre.org
References
- http://aluigi.altervista.org/adv/lieroxxx-adv.txtExploit, Vendor Advisory
- http://secunia.com/advisories/19079
- http://securityreason.com/securityalert/549
- http://www.securityfocus.com/archive/1/426864/100/0/threaded
- http://www.securityfocus.com/bid/16990
- http://www.vupen.com/english/advisories/2006/0849
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25187
- http://aluigi.altervista.org/adv/lieroxxx-adv.txtExploit, Vendor Advisory
- http://secunia.com/advisories/19079
- http://securityreason.com/securityalert/549
- http://www.securityfocus.com/archive/1/426864/100/0/threaded
- http://www.securityfocus.com/bid/16990
- http://www.vupen.com/english/advisories/2006/0849
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25187
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.