CVE-2006-3325

client/clparse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine ioquake3 revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as clallowdownload for Automatic Downloading and fshomepath for the quake3...