CVE-2020-15007

Katalog CVE

CVSS 9.8 · Critical EPSS 2,5%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada idsoftware tech 1, doom vanille project doom vanille. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine) allows arbitrary code execution via an unsafe usage of fscanf, because it does not limit the number of characters to be read in a format argument.

Rincian

Terbit di NVD

24 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec patch · advisory pihak ketiga
• https://twitter.com/notrevenant/status/1268654123903340544 advisory pihak ketiga