Back to Database
Status published
Critical
CVE-2009-0367
The Python AI module in Wesnoth 1.4.x and 1.5 before...
Vulnerability Description
The Python AI module in Wesnoth 1.4.x and 1.5 before 1.5.11 allows remote attackers to escape the sandbox and execute arbitrary code by using a whitelisted module that imports an unsafe module, then using a hierarchical module name to access the unsafe module through the whitelisted module.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-0367
Credits & Attribution
No credits recorded in the NVD database.
References
- http://launchpad.net/bugs/336396
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.5.12-1/changelog
- https://gna.org/bugs/index.php?13048
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49058
- http://www.wesnoth.org/forum/viewtopic.php?t=24340
- http://packages.debian.org/changelogs/pool/main/w/wesnoth/wesnoth_1.4.7-4/changelog
- http://www.wesnoth.org/forum/viewtopic.php?t=24247
- http://secunia.com/advisories/34058
- http://www.vupen.com/english/advisories/2009/0595
- http://launchpad.net/bugs/cve/2009-0367
- http://secunia.com/advisories/34236
- http://www.debian.org/security/2009/dsa-1737
- http://launchpad.net/bugs/335089
More from wesnoth
View All →CVE-2018-1999023
The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains...
High
8.8
CVE-2015-5070
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function...
Low
3.1
CVE-2015-5069
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function...
Medium
4.3
CVE-2015-0844
The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x...
Medium
5
CVE-2009-0878
The read_game_map function in src/terrain_translation.cpp in Wesnoth before r32987 allows...
Medium
5
Affected Vendor
wesnoth
View all reports →Affected Software
wesnoth
Vulnerable Versions:
1.4, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.5.10
Timeline
Official Publish:
March 5th, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.