The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players     value, leading to a buffer overflow. A malicious user can overwrite the server's stack. (CVE-2020-14983)

Note that Nessus relies on the presence of the package as reported by the vendor.

Michal Dardas from LogicalTrust reports :

The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malicious user can overwrite the server's stack.

This update for chocolate-doom to version 3.0.1 fixes the following issues :

  - CVE-2020-14983: Fixed a stack-based buffer overflow in     the networking code (boo#1173595).

ID	Name	Product	Family	Severity
256690	Linux Distros Unpatched Vulnerability : CVE-2020-14983	Nessus	Misc.	critical
145349	FreeBSD : chocolate-doom -- Arbitrary code execution (35aef72c-5c8e-11eb-8309-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	critical
138729	openSUSE Security Update : chocolate-doom (openSUSE-2020-939)	Nessus	SuSE Local Security Checks	critical
138723	openSUSE Security Update : chocolate-doom (openSUSE-2020-928)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-14983

critical

Tenable Plugins

critical

critical

critical

critical