The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNewClientLevel functions in sv_main.cpp for (a) Zdaemon 1.08.01 and (b) X-Doom allows remote attackers to cause a denial of service (crash) via an invalid player slot or item number, which causes an invalid memory access, possibly due to an invalid array index.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| X-doom | X-doom | 1.06.07 (including) | 1.06.07 (including) |
| Zdaemon | Zdaemon | * | 1.08.01 (including) |