CVE-2010-2445

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-07-08 · updated 2026-06-16
Weakness: CWE-78

Description

freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions.

Affected products

freeciv: 2.2.0, 2.2.0-beta1, 2.2.0-beta2, 2.2.0-beta3, 2.2.0-rc1, 2.3.0-dev

References

http://gna.org/bugs/?15624
http://packetstormsecurity.com/files/163311/Android-2.0-FreeCIV-Arbitrary-Code-Execution.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:205
http://www.openwall.com/lists/oss-security/2010/06/09/4
http://www.openwall.com/lists/oss-security/2010/06/24/5
http://www.osvdb.org/65192
http://gna.org/bugs/?15624
http://packetstormsecurity.com/files/163311/Android-2.0-FreeCIV-Arbitrary-Code-Execution.html
http://www.mandriva.com/security/advisories?name=MDVSA-2010:205
http://www.openwall.com/lists/oss-security/2010/06/09/4
http://www.openwall.com/lists/oss-security/2010/06/24/5
http://www.osvdb.org/65192

Get alerted when CVE-2010-2445 or the next vulnerability affects your stack