Mans Van Someren

**Name of the Vulnerable Software and Affected Versions** Teeworlds version 0.7.2 **Description** The issue is caused by an integer overflow in the CMap::Load() function, located in engine/shared/map.cpp. This overflow can lead to a buffer overflow due to the mishandling of the multiplication of width and height. **Recommendations** For Teeworlds version 0.7.2, consider applying a patch or fix that correctly handles the multiplication of width and height in the CMap::Load() function to prevent the integer overflow and subsequent buffer overflow.

**Name of the Vulnerable Software and Affected Versions** Teeworlds version 0.7.2 **Description** The issue is related to a failed bounds check in certain functions within the engine/shared/datafile.cpp file, specifically in CDataFileReader::GetData() and CDataFileReader::ReplaceData(), which can lead to an arbitrary free and out-of-bounds pointer write. This could potentially result in remote code execution. **Recommendations** For Teeworlds version 0.7.2, consider applying a patch that fixes the bounds check issue in the affected functions, specifically CDataFileReader::GetData() and CDataFileReader::ReplaceData(), to prevent arbitrary free and out-of-bounds pointer write. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Teeworlds version 0.7.2 **Description** The issue is caused by an integer overflow in the CDataFileReader::Open() function, located in engine/shared/datafile.cpp. This overflow can lead to a buffer overflow, potentially resulting in remote code execution. The problem arises from the mishandling of size-related multiplications. **Recommendations** For Teeworlds version 0.7.2, consider restricting access to the CDataFileReader::Open() function until a patch is available. As a temporary workaround, avoid using the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.