{"id":"CVE-2019-10877","aliases":["DEBIAN-CVE-2019-10877","EUVD-2019-2599","GHSA-r7vf-92cg-qg9c","UBUNTU-CVE-2019-10877","openSUSE-SU-2019:1793-1","openSUSE-SU-2019:1999-1"],"status":"published","title":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that...","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02243,"percentile":0.82982,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2019-04-05T04:31:14Z","modified":"2026-10-20T10:51:35Z","fixes":[{"ecosystem":"Debian:12","package":"teeworlds","fixed_in":["0.7.2-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"teeworlds","fixed_in":["0.7.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"teeworlds","fixed_in":["0.7.2-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"teeworlds","fixed_in":["0.7.2-5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2-5"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3.1-lp151.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"teeworlds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.3.1-bp151.2.3.3"}]}],"bundled":4}],"products":[{"vendor":"teeworlds","product":"teeworlds"}],"references":[{"url":"https://github.com/teeworlds/teeworlds/issues/2071","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10877"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5KCS2CFDYJFBLZ4QKVPNJWHOZEGQ2LBC/"},{"url":"https://github.com/advisories/GHSA-r7vf-92cg-qg9c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-10877","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10877","tags":["report"]},{"url":"https://github.com/teeworlds/teeworlds/commit/d25869626a8cfbdd320929ba93ce73abed1402ce","tags":["report"]},{"url":"https://github.com/teeworlds/teeworlds/commit/e086f4b35b1adf7edc35b4ad332dc7ed1edc5988","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10877","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV/#CR2IUNRFXJC6NRJKQUUDA2UXIVJTXQQV","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1112910","tags":["report"]},{"url":"https://bugzilla.suse.com/1131729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10879","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BSXIXG63QPG2DGPK6YFCHV7VZAMSWWYP/#BSXIXG63QPG2DGPK6YFCHV7VZAMSWWYP","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10877","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T04:31:14Z","modified":"2024-08-04T22:32:02.121Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2019-2599","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T04:31:14Z","modified":"2024-08-04T22:32:02Z","updated_at":"2026-11-03T02:40:51.198112Z"}],"ghsa":[{"id":"GHSA-r7vf-92cg-qg9c","title":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that...","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2022-05-14T01:05:27Z","modified":"2023-02-02T05:03:02Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:51:33.40906Z"}],"nvd":[{"id":"CVE-2019-10877","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T06:29:00.173Z","modified":"2026-06-17T02:11:46.39Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-10877","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T06:29:00.173Z","modified":"2026-10-20T10:51:35.858631226Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"DEBIAN-CVE-2019-10877","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T06:29:00.173Z","modified":"2026-09-21T07:01:58.447673931Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2019-10877","description":"In Teeworlds 0.7.2, there is an integer overflow in CMap::Load() in engine/shared/map.cpp that can lead to a buffer overflow, because multiplication of width and height is mishandled.","status":"published","published":"2019-04-05T06:29:00Z","modified":"2025-10-24T04:47:36Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.202697Z"},{"id":"openSUSE-SU-2019:1793-1","title":"Security update for teeworlds","description":"This update for teeworlds fixes the following issues:\n\n- CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729)\n- CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.\n- CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled.\n- CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910)\n\n- Update to version 0.7.3.1\n  * Colorful gametype and level icons in the browser instead of\n    grayscale.\n  * Add an option to use raw mouse inputs, revert to (0.6) relative\n    mode by default.\n  * Demo list marker indicator.\n  * Restore ingame Player and Tee menus, add a warning that a\n    reconnect is needed.\n  * Emotes can now be cancelled by releasing the mouse in the\n    middle of the circle.\n  * Improve add friend text.\n  * Add a confirmation for removing a filter\n  * Add a 'click a player to follow' hint\n  * Also hint players which key they should press to set themselves\n    ready.\n  * fixed using correct array measurements when placing egg doodads\n  * fixed demo recorder downloaded maps using the sha256 hash\n  * show correct game release version in the start menu and console\n  * Fix platform-specific client libraries for Linux\n  * advanced scoreboard with game statistics\n  * joystick support (experimental!)\n  * copy paste (one-way)\n  * bot cosmetics (a visual difference between players and NPCs)\n  * chat commands (type / in chat)\n  * players can change skin without leaving the server (again)\n  * live automapper and complete rules for 0.7 tilesets\n  * audio toggling HUD\n  * an Easter surprise...\n  * new gametypes: 'last man standing' (LMS) and 'last team standing'\n    (LTS). survive by your own or as a team with limited weaponry\n  * 64 players support. official gametypes are still restricted to 16\n    players maximum but allow more spectators\n  * new skin system. build your own skins based on a variety of\n    provided parts\n  * enhanced security. all communications require a handshake and use\n    a token to counter spoofing and reflection attacks\n  * new maps: ctf8, dm3, lms1. Click to discover them!\n  * animated background menu map: jungle, heavens (day/night themes,\n    customisable in the map editor)\n  * new design for the menus: added start menus, reworked server\n    browser, settings\n  * customisable gametype icons (browser). make your own!\n  * chat overhaul, whispers (private messages)\n  * composed binds (ctrl+, shift+, alt+)\n  * scoreboard remodelled, now shows kills/deaths\n  * demo markers\n  * master server list cache (in case the masters are unreachable)\n  * input separated from rendering (optimisation)\n  * upgrade to SDL2. support for multiple monitors, non-english\n    keyboards, and more\n  * broadcasts overhaul, optional colours support\n  * ready system, for competitive settings\n  * server difficulty setting (casual, competitive, normal), shown in\n    the browser\n  * spectator mode improvements: follow flags, click on players\n  * bot flags for modified servers: indicate NPCs, can be filtered out\n    in the server browser\n  * sharper graphics all around (no more tileset_borderfix and dilate)\n  * refreshed the HUD, ninja cooldown, new mouse cursor\n  * mapres update (higher resolution, fixes...)\n","status":"published","published":"2019-07-23T11:22:31Z","modified":"2026-02-04T04:04:25.851993Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1999-1","title":"Security update for teeworlds","description":"This update for teeworlds fixes the following issues:\n\n- CVE-2019-10879: An integer overflow in CDataFileReader::Open() could have lead to a buffer overflow and possibly remote code execution, because size-related multiplications were mishandled. (boo#1131729)\n- CVE-2019-10878: A failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions could have lead to an arbitrary free and out-of-bounds pointer write, possibly resulting in remote code execution.\n- CVE-2019-10877: An integer overflow in CMap::Load() could have lead to a buffer overflow, because multiplication of width and height were mishandled.\n- CVE-2018-18541: Connection packets could have been forged. There was no challenge-response involved in the connection build up. A remote attacker could have sent connection packets from a spoofed IP address and occupy all server slots, or even use them for a reflection attack using map download packets. (boo#1112910)\n\n- Update to version 0.7.3.1\n  * Colorful gametype and level icons in the browser instead of\n    grayscale.\n  * Add an option to use raw mouse inputs, revert to (0.6) relative\n    mode by default.\n  * Demo list marker indicator.\n  * Restore ingame Player and Tee menus, add a warning that a\n    reconnect is needed.\n  * Emotes can now be cancelled by releasing the mouse in the\n    middle of the circle.\n  * Improve add friend text.\n  * Add a confirmation for removing a filter\n  * Add a 'click a player to follow' hint\n  * Also hint players which key they should press to set themselves\n    ready.\n  * fixed using correct array measurements when placing egg doodads\n  * fixed demo recorder downloaded maps using the sha256 hash\n  * show correct game release version in the start menu and console\n  * Fix platform-specific client libraries for Linux\n  * advanced scoreboard with game statistics\n  * joystick support (experimental!)\n  * copy paste (one-way)\n  * bot cosmetics (a visual difference between players and NPCs)\n  * chat commands (type / in chat)\n  * players can change skin without leaving the server (again)\n  * live automapper and complete rules for 0.7 tilesets\n  * audio toggling HUD\n  * an Easter surprise...\n  * new gametypes: 'last man standing' (LMS) and 'last team standing'\n    (LTS). survive by your own or as a team with limited weaponry\n  * 64 players support. official gametypes are still restricted to 16\n    players maximum but allow more spectators\n  * new skin system. build your own skins based on a variety of\n    provided parts\n  * enhanced security. all communications require a handshake and use\n    a token to counter spoofing and reflection attacks\n  * new maps: ctf8, dm3, lms1. Click to discover them!\n  * animated background menu map: jungle, heavens (day/night themes,\n    customisable in the map editor)\n  * new design for the menus: added start menus, reworked server\n    browser, settings\n  * customisable gametype icons (browser). make your own!\n  * chat overhaul, whispers (private messages)\n  * composed binds (ctrl+, shift+, alt+)\n  * scoreboard remodelled, now shows kills/deaths\n  * demo markers\n  * master server list cache (in case the masters are unreachable)\n  * input separated from rendering (optimisation)\n  * upgrade to SDL2. support for multiple monitors, non-english\n    keyboards, and more\n  * broadcasts overhaul, optional colours support\n  * ready system, for competitive settings\n  * server difficulty setting (casual, competitive, normal), shown in\n    the browser\n  * spectator mode improvements: follow flags, click on players\n  * bot flags for modified servers: indicate NPCs, can be filtered out\n    in the server browser\n  * sharper graphics all around (no more tileset_borderfix and dilate)\n  * refreshed the HUD, ninja cooldown, new mouse cursor\n  * mapres update (higher resolution, fixes...)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-24T10:20:03Z","modified":"2025-05-07T18:10:10.273236Z","updated_at":"2026-11-02T16:58:30.784344Z"}]}}