The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locations and possibly execute arbitrary code via vectors involving snap handling.
{ "binaries": [ { "binary_name": "teeworlds", "binary_version": "0.6.4+dfsg-1" }, { "binary_name": "teeworlds-data", "binary_version": "0.6.4+dfsg-1" }, { "binary_name": "teeworlds-dbgsym", "binary_version": "0.6.4+dfsg-1" }, { "binary_name": "teeworlds-server", "binary_version": "0.6.4+dfsg-1" }, { "binary_name": "teeworlds-server-dbgsym", "binary_version": "0.6.4+dfsg-1" } ], "availability": "No subscription required", "ubuntu_priority": "medium" }