CVE-2006-2537
Multiple format string vulnerabilities in (a) OpenBOR 2.0046 and earlier, (b) Beats of Rage (BOR) 1.0029 and earlier, and (c) Horizontal Shooter BOR (HOR) 2.0000 and earlier allow remote attackers to execute code via format string specifiers in…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.80%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple format string vulnerabilities in (a) OpenBOR 2.0046 and earlier, (b) Beats of Rage (BOR) 1.0029 and earlier, and (c) Horizontal Shooter BOR (HOR) 2.0000 and earlier allow remote attackers to execute code via format string specifiers in configurations used in various mod files, as demonstrated by the (1) music identifier in data/scenes/intro.txt, which is not properly handled in the update function, and (2) background identifier in data/easy/1aeasy.txt, which is not properly handled in the shutdown function.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.80% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- horizontal shooter bor/horizontal shooter bor · openbor/openbor · senile team/beats of rage
- Source
- cve@mitre.org
References
- http://aluigi.altervista.org/adv/borfs-adv.txtExploit, Vendor Advisory
- http://secunia.com/advisories/20173Vendor Advisory
- http://secunia.com/advisories/20174Vendor Advisory
- http://secunia.com/advisories/20181Vendor Advisory
- http://www.osvdb.org/25687
- http://www.securityfocus.com/bid/18088
- http://www.vupen.com/english/advisories/2006/1901
- http://www.vupen.com/english/advisories/2006/1902
- http://www.vupen.com/english/advisories/2006/1903
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26582
- http://aluigi.altervista.org/adv/borfs-adv.txtExploit, Vendor Advisory
- http://secunia.com/advisories/20173Vendor Advisory
- http://secunia.com/advisories/20174Vendor Advisory
- http://secunia.com/advisories/20181Vendor Advisory
- http://www.osvdb.org/25687
- http://www.securityfocus.com/bid/18088
- http://www.vupen.com/english/advisories/2006/1901
- http://www.vupen.com/english/advisories/2006/1902
- http://www.vupen.com/english/advisories/2006/1903
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26582
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.