{"id":"CVE-2019-10648","aliases":["DEBIAN-CVE-2019-10648","EUVD-2019-0427","GHSA-q2xp-75m7-gv52","UBUNTU-CVE-2019-10648","USN-8385-1"],"status":"published","title":"Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02289,"percentile":0.83322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-862"],"published":"2019-03-30T12:53:57Z","modified":"2026-10-20T13:45:26Z","fixes":[{"ecosystem":"Maven","package":"net.sf.robocode:robocode.host","fixed_in":["1.9.3.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"robocode","fixed_in":["1.9.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"robocode","fixed_in":["1.9.3.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"robocode","fixed_in":["1.9.3.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","fixed_in":["1.9.2.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","fixed_in":["1.9.3.1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sf.robocode:robocode.host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.9.3.5"},{"fixed":"1.9.3.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.3-2"}]}]},{"source":"osv","ecosystem":"Maven","package":"net.sf.robocode:robocode.host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"],"bundled":4}],"products":[{"vendor":"robocode","product":"robocode"}],"references":[{"url":"https://github.com/robo-code/robocode/commit/836c84635e982e74f2f2771b2c8640c3a34221bd#diff-0296a8f9d4a509789f4dc4f052d9c36f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://sourceforge.net/p/robocode/bugs/406/","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10648","tags":["advisory"]},{"url":"https://sourceforge.net/p/robocode/bugs/406","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q2xp-75m7-gv52"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10648","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10648","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8385-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-14306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14308","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-10648","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T12:53:57Z","modified":"2024-08-04T22:31:59.962Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-0427","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T12:53:57Z","modified":"2024-08-04T22:31:59Z","updated_at":"2026-11-03T02:40:51.633398Z"}],"ghsa":[{"id":"GHSA-q2xp-75m7-gv52","title":"Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-04-02T15:36:49Z","modified":"2025-12-22T18:42:02Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-862"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2019-10648","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T13:29:00.657Z","modified":"2026-06-17T02:11:26.397Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-10648","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T13:29:00.657Z","modified":"2026-10-20T13:45:26.925054179Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10648","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T13:29:00.657Z","modified":"2026-09-21T07:00:51.861400032Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"GHSA-q2xp-75m7-gv52","title":"Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-04-02T15:36:49Z","modified":"2025-12-22T18:51:12.33106Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-862"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"UBUNTU-CVE-2019-10648","description":"Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.","status":"published","published":"2019-03-30T13:29:00Z","modified":"2026-06-04T22:49:22.083471241Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"USN-8385-1","title":"robocode vulnerabilities","description":"It was discovered that Robocode could be tricked into making network\nrequests to attacker-controlled systems. An attacker could possibly use\nthis issue to cause external service interaction, resulting in\ninformation disclosure. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-10648)\n\nLim Sim Yee discovered that Robocode did not properly validate file\npaths in the CacheCleaner component. An attacker could possibly use this\nissue to delete arbitrary files. (CVE-2025-14306)\n\nLim Sim Yee discovered that Robocode did not securely create temporary\nfiles in the AutoExtract component. An attacker could possibly use this\nissue to manipulate temporary files, resulting in arbitrary code\nexecution. (CVE-2025-14307)\n\nLim Sim Yee discovered that Robocode did not properly validate data\nlengths in the Buffer class. An attacker could possibly use this issue\nto trigger an integer overflow, resulting in arbitrary code execution.\n(CVE-2025-14308)","status":"published","published":"2026-06-04T13:59:44Z","modified":"2026-06-04T23:03:42.629564035Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}