Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.

**Security update: Godot 3.0.6**

This update brings the latest upstream release of Godot Engine, with several bug fixes and improvements applied on top of Godot 3.0.4. This release is compatible with previous Godot 3.0.x versions and should load existing projects without issue.

Version 3.0.6 also fixes the following security vulnerabilities :

Fabio Alessandrelli found and fixed several security vulnerabilities in the marshalling code of Godot Engine, which could be used by a remote Godot client to cause a Denial of Service for a Godot server (CVE-2018-1000224).

*References:*

  - Release announcement:
    https://godotengine.org/article/maintenance-release-godo     t-3-0-6

  - Changelog:
    https://downloads.tuxfamily.org/godotengine/3.0.6/Godot_     v3.0.6-stable_changelog.txt

  - Details about CVE-2018-1000224:
    https://github.com/godotengine/godot/issues/20558

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
120702	Fedora 28 : godot (2018-ad83f27a39)	Nessus	Fedora Local Security Checks	high
120602	Fedora 29 : godot (2018-8d58297dc0)	Nessus	Fedora Local Security Checks	high
117439	Fedora 27 : godot (2018-6121f427e5)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-1000224

high

Tenable Plugins

high

high

high