CVE-2022-51015 PocketMine-MP before 4.0.6 Denial of Service via PlayerActionPacket

PocketMine-MP before 4.0.6 does not validate facing values in PlayerActionPacket for STARTBREAK and CRACKBREAK actions or in UseItemTransactionData typically within InventoryTransactionPacket. A remote authenticated attacker can send crafted packets with invalid facing values e.g., negative or...

Unchecked validity of Facing values in PlayerActionPacket

Impact A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values e.g. negative, specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket. Patches f126479c37ff00a717a828f5271cf8e821d12d6c...

GHSA-XH99-HW7H-WF63 Unchecked validity of Facing values in PlayerActionPacket

Impact A remote attacker may crash a server by sending PlayerActionPacket with invalid facing values e.g. negative, specifically with STARTBREAK or CRACKBLOCK actions, or with a UseItemTransactionData typically in InventoryTransactionPacket. Patches f126479c37ff00a717a828f5271cf8e821d12d6c...