An issue was discovered in savestruct_internal.c in FreedroidRPG 1.0rc2. Saved game files are composed of Lua scripts that recover a game’s state. A file can be modified to put any Lua code inside, leading to arbitrary code execution while loading.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14939
Reference (s):
- https://bugs.freedroid.org/b/issue953
- https://logicaltrust.net/blog/2020/02/freedroid.html