CVE-2015-5070
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in...
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
- Record
CVE-2015-5070- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
- Record
CVE-2015-5070- Updated
- 2026-11-02
EUVDEUVD-2015-5086 No score
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
- Record
EUVD-2015-5086- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3rx6-q2qg-r8cc
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in...
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
- Record
GHSA-3rx6-q2qg-r8cc- CVSS 3.0
- 3.1 Low
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVMGASA-2015-0282 No score
Updated wesnoth packages fix security vulnerability
Toom Lõhmus discovered that the Lua API and preprocessor in the Battle for Wesnoth game up to version 1.12.2 included could lead to client-side authentication information disclosure using maliciously crafted files with the .pdb extension (CVE-2015-5069, CVE-2015-5070).
This issue has been fixed using patches from upstream's 1.10.x branch.
- Record
MGASA-2015-0282- Updated
- 2026-11-02
OSVMGASA-2015-0283 No score
Updated wesnoth packages fix security vulnerability
Toom Lõhmus discovered that the Lua API and preprocessor in the Battle for Wesnoth game up to version 1.12.2 included could lead to client-side authentication information disclosure using maliciously crafted files with the .pdb extension (CVE-2015-5069, CVE-2015-5070).
This issue has been fixed in version 1.12.4, which also provides a number of engine and gameplay-related bug fixes. See the referenced code and player changelogs for a detailed listing.
- Record
MGASA-2015-0283- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
wesnoth-1.8Debian:6.0 From an advisory covering 2 CVEs |
before 1:1.8.5-1+deb6u2, plus listed versions 1:1.8.5-1 |
1:1.8.5-1+deb6u2 |
wesnothMageia:4 From an advisory covering 2 CVEs |
before 1.10.7-2.2.mga4 | 1.10.7-2.2.mga4 |
wesnothMageia:5 From an advisory covering 2 CVEs |
before 1.12.4-1.mga5 | 1.12.4-1.mga5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5070 is a low vulnerability (CVSS 3.1) in Wesnoth Battle For Wesnoth, published July 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. No source names a fixed version.
References
securityfocus.com/bid/75425
github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59
lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.html
bugzilla.redhat.com/show_bug.cgi?id=1236010
Show 14 moreShow less
gna.org/bugs?23504
openwall.com/lists/oss-security/2015/06/25/12
nvd.nist.gov/vuln/detail/CVE-2015-5070
advisories.mageia.org/MGASA-2015-0282.html
bugs.mageia.org/show_bug.cgi?id=16208
forums.wesnoth.org/viewtopic.php?t=42776