Bugzilla Bug 125304

Freeciv supports both plain and compressed data (admins can disable
this feature only recompiling the server from the source code with
USE_COMPRESSION undefined).
When the server receives a jumbo data (size set to 0xffff) it reads
the subsequent 32 bits number which identifies the size of the
compressed data.
Then it makes a signed comparison to know if the compressed size is
major than the data received, if the client uses a negative compressed
size value it will be able to elude this check.
After having substracted 6 bytes (header size) from this number the
server tries to allocate the memory needed for decompressing the data
which is fixed to 100 times this size.
If the memory cannot be allocated the server terminates or freezes
showing an out of memory message.

http://aluigi.altervista.org/adv/freecivdos-adv.txt

arches please test and mark stable, thank you.

I'm assuming you mean 2.0.8 here, but please use exact versions in the future
to avoid any confusion.

x86 is stable.

sparcenstein!

Removing x86 which is already marked stable

Marked ppc stable by Pylon, tested by mabi.

removing ppc from CC because of comment #6

alpha is always ready for fun! 

eer ... alpha stable.

amd64 stable, sorry for the delay

No RCE, no critical service - tend to say no here

2.0.7 has been removed from portage.

Bad players can kill the game server, I tend to vote yes, so we'll need one
more opinion :) We usually don't issue GLSAs for game servers DoS though.

Ah well, you know what: i happened to have some spare time to draft and you are
the leader, so i'll follow you - let's have a glsa.

GLSA 200603-11

Thanks everybody.