Description
Buffer overflow in pl_main.c in sail in BSDgames before 2.17-7 allows local users to execute arbitrary code via a long player name that is used in a scanf function call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bsdgames | 2.17-7 | — |
| Debian 13 | bsdgames | 2.17-7 | — |
| Debian 12 | bsdgames | 2.17-7 | — |
| Debian 3.1 | bsdgames | 2.7.59-7sarge1 | DSA-1036-1 |
| Debian 3.0 | bsdgames | 2.13-7woody0 | DSA-1036-1 |
Advisories 1
- DSA-1036-1 bsdgames - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=360989
- http://www.pulltheplug.org/fu/?q=node/56
- 736 third-party-advisory
- DSA-1036 vendor-advisory
- 17401 vdb-entry
- 19687 third-party-advisory
- 24634 vdb-entry