GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and cmd_pgnreplay functions in frontend/cmd.cc.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7336-1 advisory.

    Michael Vaughan discovered an overflow vulnerability in GNU Chess that occurs when reading a specially     crafted Portable Game Notation (PGN) file. An attacker could possibly use this issue to cause GNU Chess to     crash, resulting in a denial of service, or the execution of arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4014 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4014-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     January 12, 2025                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : gnuchess     Version        : 6.2.7-1+deb11u1     CVE ID         : CVE-2021-30184


    An issue has been found in gnuchess, a tool to play a game of chess,     either against the user or against itself.
    The issue is related to arbitrary code execution via crafted PGN (Portable     Game Notation) data.



    For Debian 11 bullseye, this problem has been fixed in version     6.2.7-1+deb11u1.

    We recommend that you upgrade your gnuchess packages.

    For the detailed security status of gnuchess please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gnuchess

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
    This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and
    cmd_pgnreplay functions in frontend/cmd.cc. (CVE-2021-30184)

The remote host is affected by the vulnerability described in GLSA-202107-28 (GNU Chess: Buffer overflow)

    The cmd_pgnload() and cmd_pgnreplay() functions in cmd.cc in GNU Chess       to not sufficiently validate PGN file input, potentially resulting in a       buffer overflow.
  Impact :

    A remote attacker could entice a user to open a specially crafted PGN       file using GNU Chess, possibly resulting in execution of arbitrary code       with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-2c714d311f advisory.

  - GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
    This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and     cmd_pgnreplay functions in frontend/cmd.cc. (CVE-2021-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-a58cb9bc7a advisory.

  - GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN (Portable Game Notation) data.
    This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd_pgnload and     cmd_pgnreplay functions in frontend/cmd.cc. (CVE-2021-30184)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
232317	Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : GNU Chess vulnerability (USN-7336-1)	Nessus	Ubuntu Local Security Checks	high
213994	Debian dla-4014 : gnuchess - security update	Nessus	Debian Local Security Checks	high
404693	Alpine: multiple gnuchess packages: security update to 6.2.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404693	Alpine: multiple gnuchess packages: security update to 6.2.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
157008	GLSA-202107-28 : GNU Chess: Buffer overflow	Nessus	Gentoo Local Security Checks	high
148722	Fedora 33 : gnuchess (2021-2c714d311f)	Nessus	Fedora Local Security Checks	high
148717	Fedora 32 : gnuchess (2021-a58cb9bc7a)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2021-30184

high

Tenable Plugins

high

high

high

high

high

high

high