CVE-2015-5070

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.

• CWE-200

• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/25/12Mailing List, Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/75425Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1236010Issue Tracking, Patch, Third Party Advisory, VDB Entry
• https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59Patch, Third Party Advisory
• https://github.com/wesnoth/wesnoth/releases/tag/1.12.4Release Notes, Third Party Advisory
• https://github.com/wesnoth/wesnoth/releases/tag/1.13.1Release Notes, Third Party Advisory
• https://gna.org/bugs/?23504Broken Link
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161722.htmlThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161752.htmlThird Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/25/12Mailing List, Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/75425Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1236010Issue Tracking, Patch, Third Party Advisory, VDB Entry
• https://github.com/wesnoth/wesnoth/commit/b2738ffb2fdd2550ececb74f76f75583c43c8b59Patch, Third Party Advisory
• https://github.com/wesnoth/wesnoth/releases/tag/1.12.4Release Notes, Third Party Advisory
• https://github.com/wesnoth/wesnoth/releases/tag/1.13.1Release Notes, Third Party Advisory
• https://gna.org/bugs/?23504Broken Link

Published

Sep 26, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5064Multiple cross-site scripting (XSS) vulnerabilities in MySql…
• CVE-2015-5065Absolute path traversal vulnerability in proxy.php in the go…
• CVE-2015-5066Multiple cross-site scripting (XSS) vulnerabilities in the M…
• CVE-2015-5067The (1) Cross-System Tools and (2) Data Transfer Workbench i…
• CVE-2015-5068XML external entity (XXE) vulnerability in SAP Mobile Platfo…
• CVE-2015-5069The (1) filesystem::get_wml_location function in filesystem.…
• CVE-2015-5071AR System Mid Tier in the AR System Mid Tier component befor…6.5
• CVE-2015-5072The BIRT Engine servlet in the AR System Mid Tier component …6.5
• CVE-2015-5073Heap-based buffer overflow in the find_fixedlength function …
• CVE-2015-5074Incomplete blacklist vulnerability in the FileUploadsFilter …
• CVE-2015-5075Cross-site request forgery (CSRF) vulnerability in X2Engine …
• CVE-2015-5076Multiple cross-site scripting (XSS) vulnerabilities in X2Eng…