2025.8.e.3: "EAGLES"
[p]\[Note: this patch went briefly live earlier this week, but it broke custom key bindings. We rolled it back, and that's fixed now.]
[/p][h3]2025.8.e.3: "EAGLES"[/h3][p]
A number of tiny ameliorations from the redoubtable Chelnoque[/p]
[/p][h3]2025.8.e.3: "EAGLES"[/h3][p]
A number of tiny ameliorations from the redoubtable Chelnoque[/p]
- [p]Perfected skills stop displaying upgrade slots[/p]
- [p]Films and phonograph records can no longer be contaminated[/p]
- [p]The cursor is anchored more thoroughly when trying to zoom right after moving the camera with keys[/p]
- [p]Verb windows now (again) resize correctly on slots removal[/p]
- [p]Better hitbox for a craftable recipe selection[/p]
- [p]Better support of ultrawide resolutions[/p]
- [p]Edge scrolling now retains consistent speed regardless of the zoom level[/p]
- [p]Fixed an assortment of bugs that occured during the key rebinding[/p]
- [p]In Severn Chamber, a certain comfort slot placement area was too short[/p]
- [p]In terrain unlock preview window, the period image was placed incorrectly when the preview description was only a single line[/p]
- [p]Various Japanese localisation fixes[/p]
- [p]Unity security update[/p]
bh.exe -overrideMonoSearchPath "C:\\somefolder\\ransomware.dll"[p] [/p][p]Importantly, they couldn't make the game load code from a remote location. So someone has to (a) get the code on to your machine or a local network path, then (b) convince you to run the relevant command line, which isn't straightforward. But on Windows, it's quite easy to register an application to open any URL in a specified format, like this[/p][p][/p]
steam://getSteamToDoSomeConfigAction[p][/p][p]So attacker tricks you into (a) registering "bookofhours://" as a schema and then (b) gets you to click a link like this[/p][p][/p]
bookofhours:// -overrideMonoSearchPath "aSimpleHttpURLWouldntWorkButAttackerCouldPotentiallyGetCreativeAndMakeYouDownloadAFIle"[p][/p][p]Windows tells Book to start running and supplies the -overrideMonoSearchPath as a launch parameter. Poor Book obediently tries to load the file supplied in the malicious link, maybe it works, and if it does, you're now running their code.[/p][p][/p][p]So again, someone still needs to convince you to run an app in the first place to register Book as a schema handler, maybe your AV software will flag the download, idk, but the Internet is rife with clever cyber bastards. And it's a bigger deal for a game that actually is registered as a schema handler for genuine reasons.[/p][p][/p][p]Either way, it's fixed now, for Book and a lot of other games! But there will be unmaintained games out there with the vulnerability forever, so maybe if someone's read this far, I've saved them a visit to the Misery Palace ¯\\_(ツ)_/¯[/p][p][/p][p][/p][p]https://unity.com/security/sept-2025-01/remediation[/p][p][/p][p]https://www.kaspersky.com/blog/update-unity-games-cve-2025-59489/54542/[/p][p] [/p][p][/p]










