CVE-2009-0367
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 10.9%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 10.94% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- wesnoth/wesnoth
- Source
- cve@mitre.org
References
- http://launchpad.net/bugs/335089
- http://launchpad.net/bugs/336396
- http://launchpad.net/bugs/cve/2009-0367
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog
- http://secunia.com/advisories/34058Vendor Advisory
- http://secunia.com/advisories/34236
- http://www.debian.org/security/2009/dsa-1737
- http://www.vupen.com/english/advisories/2009/0595Patch, Vendor Advisory
- http://www.wesnoth.org/forum/viewtopic.php?t=24247Patch, Vendor Advisory
- http://www.wesnoth.org/forum/viewtopic.php?t=24340Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49058
- https://gna.org/bugs/index.php?13048
- http://launchpad.net/bugs/335089
- http://launchpad.net/bugs/336396
- http://launchpad.net/bugs/cve/2009-0367
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog
- http://secunia.com/advisories/34058Vendor Advisory
- http://secunia.com/advisories/34236
- http://www.debian.org/security/2009/dsa-1737
- http://www.vupen.com/english/advisories/2009/0595Patch, Vendor Advisory
- http://www.wesnoth.org/forum/viewtopic.php?t=24247Patch, Vendor Advisory
- http://www.wesnoth.org/forum/viewtopic.php?t=24340Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49058
- https://gna.org/bugs/index.php?13048
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.