CVE-2011-2764 The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not pro...
HighCVSS 10.0
EPSS 8.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ioquake3(Debian:12) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| debian/ioquake3(Debian:13) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| debian/ioquake3(Debian:14) | < 1.36+svn1946-4 | 1.36+svn1946-4 |
| debian/openarena(Debian:12) | < 0.8.5-5+exp1 | 0.8.5-5+exp1 |
| debian/openarena(Debian:13) | < 0.8.5-5+exp1 | 0.8.5-5+exp1 |
| debian/openarena(Debian:14) | < 0.8.5-5+exp1 | 0.8.5-5+exp1 |
| ioquake3 engine | <= 1.36 | No fix listed |
| ioquake3 engine | = 1.36-rc1 | No fix listed |
| openarena | All versions | No fix listed |
| smokin-guns smokin guns | All versions | No fix listed |
| tremulous | All versions | No fix listed |
| urbanterror iourbanterror | All versions | No fix listed |
| worldofpadman world of padman | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/openarena(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2011-2764 vendor-advisory
- 20110728 Two security issues fixed in ioQuake3 engine exploit mailing-list
- FEDORA-2011-9898 vendor-advisory
- 45539 third-party-advisory
- 45540 third-party-advisory
- 8324 third-party-advisory
- svn.icculus.org patch
- thilo.tjps.eu patch
- 20110728 Two security issues fixed in ioQuake3 engine mailing-list
- 48915 vdb-entry
- bugzilla.redhat.com exploit patch
- ioquake-gamecode-code-execution(68870) vdb-entry
- GLSA-201706-23 vendor-advisory