# CVE-2018-1999023: wesnoth: The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua script...

CVE-2018-1999023 is fixed in 25 products on 1 platform, first by wesnoth 1:1.12.6-1+deb9u1build0.18.04.1, released July 23, 2018. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2018-1999023
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0172
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 23, 2018

## Description

The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and player content.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | wesnoth Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12 Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-aoi Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-aoi 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-aoi-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-core Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-core 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-core-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-data Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-data 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-data-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-did Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-did 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-did-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-dm Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-dm 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-dm-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-dw Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-dw 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-dw-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-ei Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-ei 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-ei-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-httt Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-httt 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-httt-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-l Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-l 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-l-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-low Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-low 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-low-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-music Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-music 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-music-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-nr Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-nr 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-nr-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-server Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-server 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-server-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-sof Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-sof 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-sof-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-sotbe Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-sotbe 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-sotbe-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-thot Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-thot 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-thot-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-tools Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-tools 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-tools-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-trow Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-trow 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-trow-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-tsg Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-tsg 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-tsg-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-ttb Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-ttb 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-ttb-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-1.12-utbs Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-1.12-utbs 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-1.12-utbs-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-core Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-core 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-core-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |
| Linux | wesnoth-music Ubuntu 18.04.6 LTS (bionic) | 1:1.12.6-1+deb9u1build0.18.04.1 | [wesnoth-music 1:1.12.6-1+deb9u1build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-wesnoth-music-1-1.12.6-1-deb9u1build0.18.04.1.md) | Jul 23, 2018 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.