The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locations and possibly execute arbitrary code via vectors involving snap handling.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-data" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-dbgsym" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-server" }, { "binary_version": "0.6.4+dfsg-1", "binary_name": "teeworlds-server-dbgsym" } ] }