CVE-2011-1412 sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands v...
HighCVSS 7.5
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ioquake3(Debian:12) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| debian/ioquake3(Debian:13) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| debian/ioquake3(Debian:14) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| ioquake3 engine | All versions | No fix listed |
| openarena | = 0.8.x-15 | No fix listed |
| openarena | = 0.8.x-16 | No fix listed |
| worldofpadman world of padman | = 1.5 | No fix listed |
| ubuntu/openarena(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2011-1412 vendor-advisory
- 20110728 Two security issues fixed in ioQuake3 engine exploit mailing-list
- FEDORA-2011-9898 vendor-advisory
- 45417 third-party-advisory vendor-advisory
- 45468 third-party-advisory vendor-advisory
- 8324 third-party-advisory
- svn.icculus.org patch
- thilo.tjps.eu patch
- worldofpadman.com patch
- 74137 vdb-entry
- 20110728 Two security issues fixed in ioQuake3 engine mailing-list
- 48915 vdb-entry
- bugzilla.redhat.com exploit patch
- ioquake-idtech-command-execution(68869) vdb-entry
- GLSA-201706-23 vendor-advisory