The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the     Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be     exploitable via Loading specially-crafted saved games, networked games, replays, and player content.
    (CVE-2018-1999023)

Note that Nessus relies on the presence of the package as reported by the vendor.

Fix for CVE-2018-1999023, other bugfixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

shadowm reports :

A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth version 1.7.0. Users of all previous version should upgrade immediately.

ID	Name	Product	Family	Severity
258357	Linux Distros Unpatched Vulnerability : CVE-2018-1999023	Nessus	Misc.	high
120845	Fedora 28 : wesnoth (2018-dc339c6534)	Nessus	Fedora Local Security Checks	high
117723	FreeBSD : wesnoth -- Code Injection vulnerability (bad59128-c188-11e8-9d40-f0def10dca57)	Nessus	FreeBSD Local Security Checks	high
111473	Fedora 27 : wesnoth (2018-9c0b765d2d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-1999023

high

Tenable Plugins

high

high

high

high