The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locations and possibly execute arbitrary code via vectors involving snap handling.
| Software | From | Fixed in |
|---|---|---|
| teeworlds / teeworlds | - | 0.6.4 |
| fedoraproject / fedora | 23 | 23.x |