Description
The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | wesnoth-1.14 | 1:1.14.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | wesnoth-1.12 | 1:1.12.6-1+deb9u1build0.18.04.1 | — |
| Ubuntu 16.04 LTS | wesnoth-1.12 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | wesnoth | 1.15.17-1.3 | openSUSE-SU-2024:11509-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ceph | 18.2.1-1 | — |
Advisories 1
- openSUSE-SU-2024:11509-1 wesnoth-1.15.17-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025