Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Freeciv can crash or run malicious code remotely

CVE-2006-3913 · published 20 years ago
Summary

Freeciv versions up to 2.1.0‑beta1 can be forced to stop working or potentially run attacker‑controlled code when it receives specially crafted network packets. An attacker on the network could send these malformed packets to cause a denial of service or attempt code execution. Update Freeciv to a newer release or apply the vendor’s patches to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
freeciv freeciv 2.1.0_beta1
cpe:2.3:a:freeciv:freeciv:2.1.0_beta1:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negat...
Buffer overflow in Freeciv 2.1.0-beta1 and earlier, and SVN 15 Jul 2006 and earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) negative chunk_length or a (2) large chunk->offset value in a PACKET_PLAYER_ATTRIBUTE_CHUNK packet in the generic_handle_player_attribute_chunk function in common/packets.c, and (3) a large packet->length value in the handle_unit_orders function in server/unithand.c.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
6% chance of attack within 30 days
Timeline
Published28 Jul 2006
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-3913 · NVD
Track software like this
Free during beta