CVE-2020-14983

CRITICAL

Chocolate Doom/Crispy Doom <3.0.0/<5.8.0 - Buffer Overflow

Title source: llm

Description

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

References (4)

Core 4

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

https://github.com/chocolate-doom/chocolate-doom/issues/1293

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00002.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00007.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00012.html

Scores

CVSS v3 9.8

EPSS 0.0060

EPSS Percentile 69.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-120

Status published

Products (5)

chocolate-doom/chocolate_doom 3.0.0

chocolate-doom/crispy_doom 5.8.0

opensuse/backports sle-15 sp1

opensuse/leap 15.1

opensuse/leap 15.2

Published Jun 22, 2020

Tracked Since Feb 18, 2026