Valvesoftware vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-38312 A directory traversal vulnerability in Valve Counter-Strike 8684 allows a client (with remote control access to a game server) to read arbitrary files from the High 7.5 · Oct 15, 2023
• CVE-2023-35855 A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile conCritical 9.8 · Jun 19, 2023
• CVE-2023-30382 A buffer overflow in the component hl.exe of Valve Half-Life up to 5433873 allows attackers to execute arbitrary code and escalate privileges by supplying craftHigh 7.3 · May 23, 2023
• CVE-2021-30481 Valve Steam before 2021-04-17, when a Source engine game is installed, allows remote authenticated users to execute arbitrary code because of a buffer overflow High 8 · Apr 10, 2021
• CVE-2020-6017 Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured tCritical 9.8 · Dec 3, 2020
• CVE-2020-6018 Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled uCritical 9.8 · Dec 1, 2020
• CVE-2020-6016 Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(),Critical 9.8 · Nov 18, 2020
• CVE-2020-6019 Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBase::Received_Data(),High 7.5 · Nov 13, 2020
• CVE-2020-15530 An issue was discovered in Valve Steam Client 2.10.91.91.High 7.8 · Jul 4, 2020
• CVE-2020-12242 Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account.High 7.8 · Apr 27, 2020
• CVE-2020-9005 meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafHigh 7.8 · Feb 17, 2020
• CVE-2020-7952 rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and invitingHigh 7.8 · Jan 27, 2020
• CVE-2020-7951 meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a viHigh 7.8 · Jan 27, 2020
• CVE-2020-7950 meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a viHigh 7.8 · Jan 27, 2020
• CVE-2020-7949 schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a High 7.8 · Jan 27, 2020
• CVE-2019-17180 Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in thHigh 7.8 · Oct 4, 2019
• CVE-2019-15943 vphysics.dll in Counter-Strike: Global Offensive before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming serHigh 8.8 · Sep 19, 2019
• CVE-2019-15316 Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AUTHORITY\SYSTEM) via crafted use of CreatHigh 7 · Aug 21, 2019
• CVE-2019-15315 Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local users can replace the current versions of SHigh 7.8 · Aug 21, 2019
• CVE-2017-17878 An issue was discovered in Valve Steam Link build 643.Critical 9.8 · Dec 27, 2017
• CVE-2017-17877 An issue was discovered in Valve Steam Link build 643.Critical 9.8 · Dec 27, 2017
• CVE-2015-7985 Valve Steam 2.10.91.91 uses weak permissions (Users: read and write) for the Install folder, which allows local users to gain privileges via a Trojan horse steaHigh 7.2 · Nov 24, 2015