A vulnerability, which was classified as problematic, was found in zblast 1.2.1. This affects some unknown processing in the library zblast-svgalib of the component High Score File Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in zblast-svgalib of zblast 1.2.1 and earlier allows local users to execute arbitrary code via the high score file.

The weakness was published 08/27/2003 (Website). It is possible to read the advisory at debian.org. This vulnerability is uniquely identified as CVE-2003-0613 since 07/30/2003. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 15206 (Debian DSA-369-1 : zblast - buffer overflow), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context local.

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (15206).

Productinfo

Name

• zblast

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion