CVE-2010-5077

CVE-2010-5077 affects server/sv_main.c in Quake3 Arena as used in ioquake3 before r1762, OpenArena, Tremulous, and related projects. The vulnerability allows remote attackers to cause a denial of service (network traffic amplification) by spoofing either a getstatus or an rcon request. The provid...

CVE-2011-3012

CVE-2011-3012 concerns the ioQuake3 engine (as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, ioUrbanTerror 2007-12-20). The root cause is failure to check dangerous file extensions before writing to the quake3 directory, enabling a remote attacker to execute arbitrary code via a craft...

CVE-2011-1412

CVE-2011-1412 affects the ioQuake3 engine’s Unix/Linux build used by World of Padman 1.5.x (before 1.5.1.1) and OpenArena 0.8.x-15/0.8.x-16. The vulnerability resides in sys/sys_unix.c where a long fs_game variable can be tainted with shell metacharacters, allowing a remote game server to execute...

CVE-2011-2764

CVE-2011-2764 affects the ioQuake3 engine (version 1.36 and earlier) as used in World of Padman, Smokin’ Guns, OpenArena, Tremulous, and ioUrbanTerror. The vulnerability arises from the function FS_CheckFilenameIsNotExecutable in qcommon/files.c, which does not properly detect dangerous file exte...

CVE-2012-3345

ioquake3 before r2253 is vulnerable to a local symlink attack on /tmp/ioq3.pid that allows a local user to overwrite arbitrary files. The root cause is a symlink/temporary file handling flaw that can be exploited by an unprivileged user with local access. Public advisories reference CVE-2012-3345...