CVE-2022-51015

PocketMine-MP before 4.0.6 fails to validate facing values in PlayerActionPacket (for START_BREAK and CRACK_BREAK actions) and in UseItemTransactionData (typically within InventoryTransactionPacket). A remote authenticated attacker can send crafted packets with invalid facing values (e.g., negati...

EUVD-2022-56044

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for STARTBREAK and CRACKBREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

Unchecked validity of Facing values in PlayerActionPacket

Impact A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values e.g. negative, specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket. Patches f126479c37ff00a717a828f5271cf8e821d12d6c...

GHSA-XH99-HW7H-WF63 Unchecked validity of Facing values in PlayerActionPacket

Impact A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values e.g. negative, specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket. Patches f126479c37ff00a717a828f5271cf8e821d12d6c...