{"id":"CVE-2018-18541","aliases":["DEBIAN-CVE-2018-18541","DSA-4329-1","EUVD-2018-10263","GHSA-8wj8-f5hm-vg9x","MGASA-2018-0450","UBUNTU-CVE-2018-18541","openSUSE-SU-2019:1793-1","openSUSE-SU-2019:1999-1"],"status":"published","title":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response...","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02942,"percentile":0.87232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-10-20T22:00:00Z","modified":"2026-10-23T18:03:03Z","fixes":[{"ecosystem":"Debian:12","package":"teeworlds","fixed_in":["0.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"teeworlds","fixed_in":["0.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"teeworlds","fixed_in":["0.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"teeworlds","fixed_in":["0.6.5+dfsg-1~deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"teeworlds","fixed_in":["0.6.5-1.mga6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.5+dfsg-1~deb9u1"}]}],"versions":["0.6.4+dfsg-1"]},{"source":"osv","ecosystem":"Mageia:6","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.5-1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3.1-lp151.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3.1-bp151.2.3.3"}]}],"bundled":4}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"teeworlds","product":"teeworlds"}],"references":[{"url":"https://teeworlds.com/?page=news\u0026id=12544","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/teeworlds/teeworlds/issues/1536","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://bugs.debian.org/911487","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2018/dsa-4329","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18541"},{"url":"https://github.com/advisories/GHSA-8wj8-f5hm-vg9x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18541","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0450.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23820","tags":["report"]},{"url":"https://www.teeworlds.com/?page=news\u0026id=12544","tags":["web"]},{"url":"https://github.com/teeworlds/teeworlds/commits/0.6.5-release","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-18541","tags":["report"]},{"url":"https://www.teeworlds.com/forum/viewtopic.php?id=12544","tags":["report"]},{"url":"https://github.com/teeworlds/teeworlds/commit/a263185571903ead01f6b351a91ea219ac9d215f","tags":["report"]},{"url":"https://github.com/teeworlds/teeworlds/commit/aababc63eeeee1bc41672502ca6c7a1dd9f61d94","tags":["report"]},{"url":"https://github.com/teeworlds/teeworlds/commit/f5fa1a92ed81ed8da721e803a036b1553a38e39e","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18541","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV/#CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1112910","tags":["report"]},{"url":"https://bugzilla.suse.com/1131729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10879","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BSXIXG63QPG2DGPK6YFCHV7VZAMSWWYP/#BSXIXG63QPG2DGPK6YFCHV7VZAMSWWYP","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-18541","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:00:00Z","modified":"2024-08-05T11:15:59.691Z","updated_at":"2026-11-02T14:35:11.799349Z"}],"euvd":[{"id":"EUVD-2018-10263","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:00:00Z","modified":"2024-08-05T11:15:59Z","updated_at":"2026-11-03T02:39:35.790696Z"}],"ghsa":[{"id":"GHSA-8wj8-f5hm-vg9x","title":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response...","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2022-05-14T00:55:58Z","modified":"2023-02-02T05:02:50Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:31.346473Z"}],"nvd":[{"id":"CVE-2018-18541","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:29:00.263Z","modified":"2026-06-17T01:47:28.467Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:46.409324Z"}],"osv":[{"id":"CVE-2018-18541","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:29:00.263Z","modified":"2026-10-20T13:22:44.201933837Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18541","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:29:00.263Z","modified":"2026-10-23T18:03:03.122254508Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-18541","description":"In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote attacker could send connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets.","status":"published","published":"2018-10-20T22:29:00Z","modified":"2025-10-24T04:47:15Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DSA-4329-1","title":"teeworlds - security update","status":"published","published":"2018-10-28T00:00:00Z","modified":"2026-03-09T02:08:54.590329Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0450","title":"Updated teeworlds packages fix security vulnerability","description":"It was discovered that incorrect connection setup in the server for\nTeeworlds, an online multi-player platform 2D shooter, could result in\ndenial of service via forged connection packets (rendering all game\nserver slots occupied) (CVE-2018-18541). This update fixes it.\n","status":"published","published":"2018-11-15T22:04:32Z","modified":"2026-04-16T06:24:01.645665005Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:1793-1","title":"Security update for teeworlds","description":"This update for teeworlds fixes the following issues:\n\n- CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729)\n- CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.\n- CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled.\n- CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910)\n\n- Update to version 0.7.3.1\n  * Colorful gametype and level icons in the browser instead of\n    grayscale.\n  * Add an option to use raw mouse inputs, revert to (0.6) relative\n    mode by default.\n  * Demo list marker indicator.\n  * Restore ingame Player and Tee menus, add a warning that a\n    reconnect is needed.\n  * Emotes can now be cancelled by releasing the mouse in the\n    middle of the circle.\n  * Improve add friend text.\n  * Add a confirmation for removing a filter\n  * Add a 'click a player to follow' hint\n  * Also hint players which key they should press to set themselves\n    ready.\n  * fixed using correct array measurements when placing egg doodads\n  * fixed demo recorder downloaded maps using the sha256 hash\n  * show correct game release version in the start menu and console\n  * Fix platform-specific client libraries for Linux\n  * advanced scoreboard with game statistics\n  * joystick support (experimental!)\n  * copy paste (one-way)\n  * bot cosmetics (a visual difference between players and NPCs)\n  * chat commands (type / in chat)\n  * players can change skin without leaving the server (again)\n  * live automapper and complete rules for 0.7 tilesets\n  * audio toggling HUD\n  * an Easter surprise...\n  * new gametypes: 'last man standing' (LMS) and 'last team standing'\n    (LTS). survive by your own or as a team with limited weaponry\n  * 64 players support. official gametypes are still restricted to 16\n    players maximum but allow more spectators\n  * new skin system. build your own skins based on a variety of\n    provided parts\n  * enhanced security. all communications require a handshake and use\n    a token to counter spoofing and reflection attacks\n  * new maps: ctf8, dm3, lms1. Click to discover them!\n  * animated background menu map: jungle, heavens (day/night themes,\n    customisable in the map editor)\n  * new design for the menus: added start menus, reworked server\n    browser, settings\n  * customisable gametype icons (browser). make your own!\n  * chat overhaul, whispers (private messages)\n  * composed binds (ctrl+, shift+, alt+)\n  * scoreboard remodelled, now shows kills/deaths\n  * demo markers\n  * master server list cache (in case the masters are unreachable)\n  * input separated from rendering (optimisation)\n  * upgrade to SDL2. support for multiple monitors, non-english\n    keyboards, and more\n  * broadcasts overhaul, optional colours support\n  * ready system, for competitive settings\n  * server difficulty setting (casual, competitive, normal), shown in\n    the browser\n  * spectator mode improvements: follow flags, click on players\n  * bot flags for modified servers: indicate NPCs, can be filtered out\n    in the server browser\n  * sharper graphics all around (no more tileset_borderfix and dilate)\n  * refreshed the HUD, ninja cooldown, new mouse cursor\n  * mapres update (higher resolution, fixes...)\n","status":"published","published":"2019-07-23T11:22:31Z","modified":"2026-02-04T04:04:25.851993Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1999-1","title":"Security update for teeworlds","description":"This update for teeworlds fixes the following issues:\n\n- CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729)\n- CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.\n- CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled.\n- CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910)\n\n- Update to version 0.7.3.1\n  * Colorful gametype and level icons in the browser instead of\n    grayscale.\n  * Add an option to use raw mouse inputs, revert to (0.6) relative\n    mode by default.\n  * Demo list marker indicator.\n  * Restore ingame Player and Tee menus, add a warning that a\n    reconnect is needed.\n  * Emotes can now be cancelled by releasing the mouse in the\n    middle of the circle.\n  * Improve add friend text.\n  * Add a confirmation for removing a filter\n  * Add a 'click a player to follow' hint\n  * Also hint players which key they should press to set themselves\n    ready.\n  * fixed using correct array measurements when placing egg doodads\n  * fixed demo recorder downloaded maps using the sha256 hash\n  * show correct game release version in the start menu and console\n  * Fix platform-specific client libraries for Linux\n  * advanced scoreboard with game statistics\n  * joystick support (experimental!)\n  * copy paste (one-way)\n  * bot cosmetics (a visual difference between players and NPCs)\n  * chat commands (type / in chat)\n  * players can change skin without leaving the server (again)\n  * live automapper and complete rules for 0.7 tilesets\n  * audio toggling HUD\n  * an Easter surprise...\n  * new gametypes: 'last man standing' (LMS) and 'last team standing'\n    (LTS). survive by your own or as a team with limited weaponry\n  * 64 players support. official gametypes are still restricted to 16\n    players maximum but allow more spectators\n  * new skin system. build your own skins based on a variety of\n    provided parts\n  * enhanced security. all communications require a handshake and use\n    a token to counter spoofing and reflection attacks\n  * new maps: ctf8, dm3, lms1. Click to discover them!\n  * animated background menu map: jungle, heavens (day/night themes,\n    customisable in the map editor)\n  * new design for the menus: added start menus, reworked server\n    browser, settings\n  * customisable gametype icons (browser). make your own!\n  * chat overhaul, whispers (private messages)\n  * composed binds (ctrl+, shift+, alt+)\n  * scoreboard remodelled, now shows kills/deaths\n  * demo markers\n  * master server list cache (in case the masters are unreachable)\n  * input separated from rendering (optimisation)\n  * upgrade to SDL2. support for multiple monitors, non-english\n    keyboards, and more\n  * broadcasts overhaul, optional colours support\n  * ready system, for competitive settings\n  * server difficulty setting (casual, competitive, normal), shown in\n    the browser\n  * spectator mode improvements: follow flags, click on players\n  * bot flags for modified servers: indicate NPCs, can be filtered out\n    in the server browser\n  * sharper graphics all around (no more tileset_borderfix and dilate)\n  * refreshed the HUD, ninja cooldown, new mouse cursor\n  * mapres update (higher resolution, fixes...)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-24T10:20:03Z","modified":"2025-05-07T18:10:10.273236Z","updated_at":"2026-11-02T16:58:30.784344Z"}]}}