Description
Multiple buffer overflows in the checkscores function in scores.c in tetris-bsd in bsd-games before 2.17-r1 in Gentoo Linux might allow local users with games group membership to gain privileges by modifying tetris-bsd.scores to contain crafted executable content, which is executed when another user launches tetris-bsd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bsdgames | 2.17-6 | — |
| Debian 13 | bsdgames | 2.17-6 | — |
| Debian 12 | bsdgames | 2.17-6 | — |
References
- http://bugs.gentoo.org/show_bug.cgi?id=122399
- 24261 vdb-entry
- bsdgames-tetrisbsd-checkscores-bo(25611) vdb-entry
- 17308 vdb-entry
- 19442 third-party-advisory
- GLSA-200603-26 vendor-advisory