Lucene search

K
cve[email protected]CVE-2007-5248
HistoryOct 06, 2007 - 5:17 p.m.

CVE-2007-5248

2007-10-0617:17:00
CWE-134
web.nvd.nist.gov
16
cve-2007-5248
format string vulnerabilities
id software doom 3
remote code execution
denial of service
punkbuster
ypg server
ucon

7.9 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.232 Low

EPSS

Percentile

96.6%

Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and Prey 1.3 and earlier, when Punkbuster (PB) is enabled, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server or (2) a PB_U packet to UCON. NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.

Affected configurations

NVD
Node
id_softwaredoom_3Range1.3.1
OR
id_softwarequake_4Range1.4.2
OR
take2gamespreyRange1.3

7.9 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.232 Low

EPSS

Percentile

96.6%

Related for CVE-2007-5248