{"id":"UBUNTU-CVE-2018-1999023","details":"The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.","modified":"2025-10-24T04:47:21Z","published":"2018-07-23T16:29:00Z","upstream":["CVE-2018-1999023"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2018-1999023"},{"type":"REPORT","url":"https://gist.github.com/shikadiqueen/45951ddc981cf8e0d9a74e4b30400380"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2018-1999023"}],"affected":[{"package":{"name":"wesnoth-1.12","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/wesnoth-1.12@1:1.12.5-1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.12.4-1build1","1:1.12.5-1"],"ecosystem_specific":{"binaries":[{"binary_name":"wesnoth","binary_version":"1:1.12.5-1"},{"binary_version":"1:1.12.5-1","binary_name":"wesnoth-1.12"},{"binary_name":"wesnoth-1.12-aoi","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-core","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-data","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-did","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-dm","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-dw","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-ei","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-httt","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-l","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-low","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-music","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-nr","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-server","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-sof","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-sotbe","binary_version":"1:1.12.5-1"},{"binary_name":"wesnoth-1.12-thot","binary_version":"1:1.12.5-1"},{"binary_version":"1:1.12.5-1","binary_name":"wesnoth-1.12-tools"},{"binary_name":"wesnoth-1.12-trow","binary_version":"1:1.12.5-1"},{"binary_version":"1:1.12.5-1","binary_name":"wesnoth-1.12-tsg"},{"binary_version":"1:1.12.5-1","binary_name":"wesnoth-1.12-ttb"},{"binary_name":"wesnoth-1.12-utbs","binary_version":"1:1.12.5-1"},{"binary_version":"1:1.12.5-1","binary_name":"wesnoth-core"},{"binary_name":"wesnoth-music","binary_version":"1:1.12.5-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-1999023.json"}},{"package":{"name":"wesnoth-1.12","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/wesnoth-1.12@1:1.12.6-1+deb9u1build0.18.04.1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.12.6-1+deb9u1build0.18.04.1"}]}],"versions":["1:1.12.6-1build2","1:1.12.6-1build3"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"wesnoth","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-1.12"},{"binary_name":"wesnoth-1.12-aoi","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-1.12-core"},{"binary_name":"wesnoth-1.12-data","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-did","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-dm","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-1.12-dw"},{"binary_name":"wesnoth-1.12-ei","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-httt","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-l","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-low","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-music","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-nr","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-server","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-sof","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-sotbe","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-thot","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-tools","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-trow","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_name":"wesnoth-1.12-tsg","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-1.12-ttb"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-1.12-utbs"},{"binary_name":"wesnoth-core","binary_version":"1:1.12.6-1+deb9u1build0.18.04.1"},{"binary_version":"1:1.12.6-1+deb9u1build0.18.04.1","binary_name":"wesnoth-music"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-1999023.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}