CVE-2015-5069

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/25/12Mailing List, Patch, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75424Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1236010Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6dPatch, Third Party Advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.12.3Release Notes, Third Party Advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.13.1Release Notes, Third Party Advisory
https://gna.org/bugs/?23504Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/25/12Mailing List, Patch, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/75424Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1236010Issue Tracking, Third Party Advisory, VDB Entry
https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6dPatch, Third Party Advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.12.3Release Notes, Third Party Advisory
https://github.com/wesnoth/wesnoth/releases/tag/1.13.1Release Notes, Third Party Advisory
https://gna.org/bugs/?23504Broken Link

Timeline

Published: Sep 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-50703.1The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth CVE-2015-50716.5AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "CVE-2015-50726.5The BIRT Engine servlet in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users CVE-2015-50739.1Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial CVE-2015-50747.5Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM be CVE-2015-50756.8Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of adminis CVE-2015-50764.3Multiple cross-site scripting (XSS) vulnerabilities in X2Engine X2CRM before 5.0.9 allow remote attackers to inject arbitrary web script or CVE-2015-50786.5SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenti CVE-2015-50797.5Directory traversal vulnerability in widgets/logs.php in BlackCat CMS before 1.1.2 allows remote attackers to read arbitrary files via a .. CVE-2015-50809.0The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before CVE-2015-50818.8Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privil CVE-2015-508210.0Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) N