CVE-2023-24283: Portable Puzzle Collection Buffer Overflow

CVE-2023-24283 Overview

CVE-2023-24283 is a buffer overflow vulnerability affecting Simon Tatham's Portable Puzzle Collection prior to version 20230116.5782e29. An attacker can trigger the flaw by supplying a crafted save file, causing a denial of service (DoS) in the affected puzzle application. The issue is categorized under [CWE-120] (Buffer Copy without Checking Size of Input). Exploitation requires local access and user interaction with the malicious save file, and the impact is limited to availability of the running puzzle process.

Critical Impact
A crafted save file can trigger a buffer overflow that crashes the puzzle application, resulting in denial of service on the affected host.

Affected Products

Simon Tatham's Portable Puzzle Collection versions before 20230116.5782e29
Distributions packaging the vulnerable upstream release (see Debian Bug Report #1028986)
Downstream builds that have not applied upstream commit c84af67

Discovery Timeline

2026-09-14 - CVE-2023-24283 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-24283

Vulnerability Analysis

The vulnerability resides in the save file parsing logic of the Portable Puzzle Collection. Save files describe puzzle state through a serialized text format that the application reads back at load time. A crafted save file can produce input that exceeds the size assumptions of a fixed-length buffer used during parsing. When the oversized data is copied without proper bounds validation, memory corruption occurs and the process terminates. The upstream fix, delivered in commit c84af67, tightens input handling in the affected parser path.

Root Cause

The root cause is a missing length check when copying attacker-controlled data from a save file into a bounded buffer, matching the [CWE-120] classification. The parser trusted the structure of the input rather than enforcing an explicit size boundary before the copy.

Attack Vector

Exploitation requires local delivery of a malicious save file and a user action to load that file in a vulnerable puzzle binary. The attacker gains no code execution or data disclosure, only the ability to crash the running puzzle process. See the Debian Bug Report #1028986 for a technical discussion of the crash reproduction.

No public exploit or proof-of-concept binary is referenced in the advisory. The vulnerability manifests when the parser processes a save file whose serialized fields exceed the expected size. Refer to the upstream commit for the corrected boundary handling.

Detection Methods for CVE-2023-24283

Indicators of Compromise

Unexpected crashes of Portable Puzzle Collection binaries shortly after opening a .sav or equivalent save file
Save files sourced from untrusted email, chat, or web downloads that target puzzle applications
Core dumps or segmentation fault log entries referencing puzzle binaries in /var/log/syslog or journalctl output

Detection Strategies

Inventory installed versions of Portable Puzzle Collection and flag any build predating 20230116.5782e29
Alert on process crash telemetry where the terminated image belongs to a puzzle binary and the parent action includes a file open
Correlate file-write events for puzzle save files originating from browser or mail client processes with subsequent puzzle process termination

Monitoring Recommendations

Monitor endpoint logs for repeated abnormal terminations of puzzle applications, which may indicate crafted save file testing
Track distribution package versions during patch cycles to confirm the fixed upstream commit is included
Review user-reported application crashes tied to shared or downloaded save files

How to Mitigate CVE-2023-24283

Immediate Actions Required

Upgrade Portable Puzzle Collection to a build that includes upstream commit c84af67 or later
Apply distribution updates addressing Debian Bug Report #1028986 on affected systems
Instruct users to avoid opening save files received from untrusted sources

Patch Information

The upstream fix is included in Portable Puzzle Collection revision 20230116.5782e29 and later. Downstream packagers should rebuild against the patched source tree referenced in the Tartarus Git repository. Verify the installed version reports a commit hash at or after c84af67.

Workarounds

Restrict save file loading to files created locally by the same user
Remove or restrict execution of puzzle binaries on multi-user systems where patching is delayed
Sandbox the puzzle process using operating system features such as AppArmor, SELinux, or Firejail to contain crashes

bash

# Configuration example: verify installed package version on Debian-based systems
dpkg -l | grep sgt-puzzles
apt-get update && apt-get install --only-upgrade sgt-puzzles