Pioneers: Multiple Denials of Service — GLSA 200711-20

Two Denial of Service vulnerabilities were discovered in Pioneers.

Affected packages

Package	games-board/pioneers on all architectures
Affected versions	< 0.11.3-r1
Unaffected versions	>= 0.11.3-r1

Background

Pioneers (formerly gnocatan) is a clone of the popular board game "The Settlers of Catan".

Description

Roland Clobus discovered that the Pioneers server may free sessions objects while they are still in use, resulting in access to invalid memory zones (CVE-2007-5933). Bas Wijnen discovered an error when closing connections which can lead to a failed assertion (CVE-2007-6010).

Impact

A remote attacker could send specially crafted data to the vulnerable server, resulting in a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All Pioneers users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=games-board/pioneers-0.11.3-r1"

References

Release date
November 14, 2007

Latest revision
November 29, 2007: 04

Severity
normal

Exploitable
remote

Bugzilla entries

198807