Path Traversal Vulnerability in Widelands: CVE-2011-4675
Summary
DEBIAN-CVE-2011-4675: The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in string... Affects widelands versions < 1:15-3. Fixed in 1:15-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Widelands is an open-source real-time strategy game that allows players to build and manage their own settlements. It features a unique gameplay style that combines resource management and strategic planning. The game is designed for multiplayer experiences over the internet, which makes it essential for the software to handle file paths securely. However, a vulnerability in its pathname canonicalization functionality has been identified, which could expose users to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4675, arises from the pathname canonicalization functionality in the io/filesystem/filesystem.cc file of Widelands versions prior to 15.1. This issue allows leading tilde (~) characters in strings received from the network to expand to home-directory pathnames, potentially enabling remote attackers to conduct absolute path traversal attacks. Such attacks could lead to the overwriting of arbitrary files during file transfers in the game, posing a significant security risk to users.
How To Fix
Minimum fixed version
1:15-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade widelandsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid playing Widelands over untrusted networks or disable file transfers until the package is updated to a secure version.
Conclusion
CVE-2011-4675 represents a significant security vulnerability in Widelands that can lead to serious consequences if not addressed. Users are strongly encouraged to update to the latest version to mitigate risks associated with this vulnerability. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for widelands →
FAQ
CVE-2011-4675 is a vulnerability in Widelands that allows remote attackers to exploit pathname canonicalization issues, leading to potential file overwriting.
If you are using a version of Widelands prior to 15.1, your installation is vulnerable to CVE-2011-4675.
If an immediate update is not possible, avoid playing over untrusted networks and consider disabling file transfers until the vulnerability is patched.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your manifest files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by CVE-2011-4675 without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for widelands.
