{"affected":[{"ecosystem_specific":{"binaries":[{"teeworlds":"0.7.3.1-lp151.2.3.1"}]},"package":{"ecosystem":"openSUSE:Leap 15.1","name":"teeworlds","purl":"pkg:rpm/opensuse/teeworlds&distro=openSUSE%20Leap%2015.1"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"0.7.3.1-lp151.2.3.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for teeworlds fixes the following issues:\n\n- CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729)\n- CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.\n- CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled.\n- CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910)\n\n- Update to version 0.7.3.1\n  * Colorful gametype and level icons in the browser instead of\n    grayscale.\n  * Add an option to use raw mouse inputs, revert to (0.6) relative\n    mode by default.\n  * Demo list marker indicator.\n  * Restore ingame Player and Tee menus, add a warning that a\n    reconnect is needed.\n  * Emotes can now be cancelled by releasing the mouse in the\n    middle of the circle.\n  * Improve add friend text.\n  * Add a confirmation for removing a filter\n  * Add a 'click a player to follow' hint\n  * Also hint players which key they should press to set themselves\n    ready.\n  * fixed using correct array measurements when placing egg doodads\n  * fixed demo recorder downloaded maps using the sha256 hash\n  * show correct game release version in the start menu and console\n  * Fix platform-specific client libraries for Linux\n  * advanced scoreboard with game statistics\n  * joystick support (experimental!)\n  * copy paste (one-way)\n  * bot cosmetics (a visual difference between players and NPCs)\n  * chat commands (type / in chat)\n  * players can change skin without leaving the server (again)\n  * live automapper and complete rules for 0.7 tilesets\n  * audio toggling HUD\n  * an Easter surprise...\n  * new gametypes: 'last man standing' (LMS) and 'last team standing'\n    (LTS). survive by your own or as a team with limited weaponry\n  * 64 players support. official gametypes are still restricted to 16\n    players maximum but allow more spectators\n  * new skin system. build your own skins based on a variety of\n    provided parts\n  * enhanced security. all communications require a handshake and use\n    a token to counter spoofing and reflection attacks\n  * new maps: ctf8, dm3, lms1. Click to discover them!\n  * animated background menu map: jungle, heavens (day/night themes,\n    customisable in the map editor)\n  * new design for the menus: added start menus, reworked server\n    browser, settings\n  * customisable gametype icons (browser). make your own!\n  * chat overhaul, whispers (private messages)\n  * composed binds (ctrl+, shift+, alt+)\n  * scoreboard remodelled, now shows kills/deaths\n  * demo markers\n  * master server list cache (in case the masters are unreachable)\n  * input separated from rendering (optimisation)\n  * upgrade to SDL2. support for multiple monitors, non-english\n    keyboards, and more\n  * broadcasts overhaul, optional colours support\n  * ready system, for competitive settings\n  * server difficulty setting (casual, competitive, normal), shown in\n    the browser\n  * spectator mode improvements: follow flags, click on players\n  * bot flags for modified servers: indicate NPCs, can be filtered out\n    in the server browser\n  * sharper graphics all around (no more tileset_borderfix and dilate)\n  * refreshed the HUD, ninja cooldown, new mouse cursor\n  * mapres update (higher resolution, fixes...)\n","id":"openSUSE-SU-2019:1793-1","modified":"2019-07-23T11:22:31Z","published":"2019-07-23T11:22:31Z","references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV/#CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV"},{"type":"REPORT","url":"https://bugzilla.suse.com/1112910"},{"type":"REPORT","url":"https://bugzilla.suse.com/1131729"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2018-18541"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10877"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10878"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2019-10879"}],"related":["CVE-2018-18541","CVE-2019-10877","CVE-2019-10878","CVE-2019-10879"],"summary":"Security update for teeworlds","upstream":["CVE-2018-18541","CVE-2019-10877","CVE-2019-10878","CVE-2019-10879"]}