{"id":"CVE-2007-3917","aliases":["DEBIAN-CVE-2007-3917","DSA-1386-1","EUVD-2007-3901","GHSA-5x5x-c9q8-x83f"],"status":"published","title":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers...","description":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02105,"percentile":0.81846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2007-10-11T10:00:00Z","modified":"2026-06-16T22:43:03Z","fixes":[{"ecosystem":"Debian:4.0","package":"wesnoth","fixed_in":["1.2-2"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"wesnoth","fixed_in":["0.9.0-6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:4.0","package":"wesnoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-2"}]}],"versions":["1.2-1"]},{"source":"osv","ecosystem":"Debian:3.1","package":"wesnoth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-6"}]}],"versions":["0.9.0-5"]}],"products":[{"vendor":"wesnoth","product":"wesnoth"}],"references":[{"url":"http://www.wesnoth.org/forum/viewtopic.php?p=256618","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=324841","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.wesnoth.org/forum/viewtopic.php?t=18188","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://osvdb.org/41711","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/25995","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://svn.gna.org/viewcvs/wesnoth/tags/1.2.7/changelog?rev=20982\u0026view=download","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/27218","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00194.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37047","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://secunia.com/advisories/27241","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.debian.org/security/2007/dsa-1386","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2007/3449","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/27137","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3917"},{"url":"https://github.com/advisories/GHSA-5x5x-c9q8-x83f"}],"sources":{"cve":[{"id":"CVE-2007-3917","description":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.","status":"published","published":"2007-10-11T10:00:00Z","modified":"2024-08-07T14:37:05.771Z","updated_at":"2026-11-02T13:32:56.730199Z"}],"euvd":[{"id":"EUVD-2007-3901","description":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.","status":"published","published":"2007-10-11T10:00:00Z","modified":"2024-08-07T14:37:05Z","updated_at":"2026-11-03T01:16:24.023061Z"}],"ghsa":[{"id":"GHSA-5x5x-c9q8-x83f","title":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers...","description":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.","status":"published","published":"2022-05-01T18:18:34Z","modified":"2023-01-31T05:04:07Z","cwes":["CWE-134"],"updated_at":"2026-11-02T14:48:36.723893Z"}],"nvd":[{"id":"CVE-2007-3917","description":"The multiplayer engine in Wesnoth 1.2.x before 1.2.7 and 1.3.x before 1.3.9 allows remote servers to cause a denial of service (crash) via a long message with multibyte characters that can produce an invalid UTF-8 string after it is truncated, which triggers an uncaught exception, involving the truncate_message function in server/server.cpp.  NOTE: this issue affects both clients and servers.","status":"published","published":"2007-10-11T10:17:00Z","modified":"2026-06-16T22:43:03.12Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:01:22.203764Z"}],"osv":[{"id":"DSA-1386-1","title":"wesnoth","status":"published","published":"2007-10-15T00:00:00Z","modified":"2026-03-09T01:00:58.178656Z","updated_at":"2026-11-02T15:46:14.285228Z"}]}}