← back
CVE-2009-0367

CVE-2009-0367

EPSS 10.9%
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/32837unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://launchpad.net/bugs/335089http://launchpad.net/bugs/336396http://launchpad.net/bugs/cve/2009-0367http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changeloghttp://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changeloghttp://secunia.com/advisories/34058http://secunia.com/advisories/34236https://exchange.xforce.ibmcloud.com/vulnerabilities/49058https://gna.org/bugs/index.php?13048http://www.debian.org/security/2009/dsa-1737http://www.vupen.com/english/advisories/2009/0595http://www.wesnoth.org/forum/viewtopic.php?t=24247