Summary
It was discovered that Robocode could be tricked into making network
requests to attacker-controlled systems. An attacker could possibly use
this issue to cause external service interaction, resulting in
information disclosure. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2019-10648)
Lim Sim Yee discovered that Robocode did not properly validate file
paths in the CacheCleaner component. An attacker could possibly use this
issue to delete arbitrary files. (CVE-2025-14306)
Lim Sim Yee discovered that Robocode did not securely create temporary
files in the AutoExtract component. An attacker could possibly use this
issue to manipulate temporary files, resulting in arbitrary code
execution. (CVE-2025-14307)
Lim Sim Yee discovered that Robocode did not properly validate data
lengths in the Buffer class. An attacker could possibly use this issue
to trigger an integer overflow, resulting in arbitrary code execution.
(CVE-2025-14308)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | robocode | 1.9.2.5-2ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | robocode | 1.9.3.1-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | robocode | 1.9.3.7-1ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | robocode | 1.9.3.9-2ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | robocode | 1.9.3.9-3ubuntu0.1~esm1 |
| Ubuntu · Pro 26.04 LTS Pro:26.04:LTS | robocode | 1.9.3.9-4ubuntu0.26.04.1~esm1 |
Vulnerabilities 4
-
Critical 10.0
Directory Traversal in Robocode's CacheCleaner Component
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This…
-
Critical 10.0
Integer Overflow in Robocode's Buffer Write Method
An integer overflow vulnerability exists in the write method of the Buffer class in Robocode version 1.9.3.6. The method fails to properly validate the length of data being written, allowing attackers to cause an overflow, potentially leading to buffer overfl…
-
Critical 9.8
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
-
Critical 9.3
Insecure Temporary File Creation in Robocode's AutoExtract Component
An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitr…