SB2020012813 - Multiple vulnerabilities in Valve Dota 2

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2020-7952)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or execute arbitrary code.

The vulnerability exists due to a boundary error in "rendersystemdx9.dll". A remote attacker can create a gaming server, invite a victim to this server, because a crafted map is affected by memory corruption and execute arbitrary code or cause a denial of service condition on the target system.

2) Input validation error (CVE-ID: CVE-2020-7950)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or execute arbitrary code.

The vulnerability exists due to insufficient validation of user-supplied input in the "meshsystem.dll". A remote attacker can create a gaming server, invite a victim to this server, because a crafted map is mishandled during a vulnerable function call and execute arbitrary code or cause a denial of service condition on the target system.

3) Input validation error (CVE-ID: CVE-2020-7949)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or execute arbitrary code.

The vulnerability exists due to insufficient validation of user-supplied input in the "schemasystem.dll". A remote attacker can create a gaming server, invite a victim to this server, because a crafted map is mishandled during a GetValue call and execute arbitrary code or cause a denial of service condition on the target system.

Remediation

Install update from vendor's website.

References

• https://github.com/bi7s/CVE/tree/master/CVE-2020-7952
• https://github.com/bi7s/CVE/tree/master/CVE-2020-7950
• https://github.com/bi7s/CVE/tree/master/CVE-2020-7949