Description
Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negative chunk_length or a (2) large chunk->offset value in a PACKET_PLAYER_ATTRIBUTE_CHUNK packet in the generic_handle_player_attribute_chunk function in common/packets.c, and (3) a large packet->length value in the handle_unit_orders function in server/unithand.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | freeciv | 2.0.8-3 | — |
| Debian 13 | freeciv | 2.0.8-3 | — |
| Debian 12 | freeciv | 2.0.8-3 | — |
| Debian 3.1 | freeciv | 2.0.1-1sarge2 | DSA-1142-1 |
Advisories 1
- DSA-1142-1 freeciv - missing bouncary checks Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2006-2942 vdb-entry
- http://aluigi.altervista.org/adv/freecivx-adv.txt
- 21254 third-party-advisory
- freeciv-packetsc-dos(27955) vdb-entry
- 21352 third-party-advisory
- 20060723 Two crash vulnerabilities in Freeciv 2.1.0-beta1 (SVN 15 Jul 2006) mailing-list
- freeciv-unithand-dos(27956) vdb-entry
- 19117 vdb-entry
- DSA-1142 vendor-advisory
- MDKSA-2006:135 vendor-advisory
- 1296 third-party-advisory
- 21171 third-party-advisory