CVEvulnerability
CVE-2011-1412
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-08-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.
Affected configurations
• ioquake3 ioquake3 engine
• openarena openarena 0.8.x-15
• openarena openarena 0.8.x-16
• worldofpadman world of padman 1.5
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html Exploit
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html lists.fedoraproject.org
- http://secunia.com/advisories/45417 Vendor Advisory
- http://secunia.com/advisories/45468 Vendor Advisory
- http://securityreason.com/securityalert/8324 securityreason.com
- http://svn.icculus.org/quake3?view=rev&revision=2097 Patch
- http://thilo.tjps.eu/download/patches/ioq3-svn-r2097.diff Patch
- http://worldofpadman.com/website/news/en/article/266/wop-1-5-1-1-hotfix-released-for-linux.html Patch
- http://www.osvdb.org/74137 www.osvdb.org
- http://www.securityfocus.com/archive/1/519051/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/48915 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=725951 Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68869 exchange.xforce.ibmcloud.com
- https://security.gentoo.org/glsa/201706-23 security.gentoo.org
- http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html Exploit
- http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html lists.fedoraproject.org
- http://secunia.com/advisories/45417 Vendor Advisory
- http://secunia.com/advisories/45468 Vendor Advisory
- http://securityreason.com/securityalert/8324 securityreason.com
- http://svn.icculus.org/quake3?view=rev&revision=2097 Patch
- http://thilo.tjps.eu/download/patches/ioq3-svn-r2097.diff Patch
- http://worldofpadman.com/website/news/en/article/266/wop-1-5-1-1-hotfix-released-for-linux.html Patch
- http://www.osvdb.org/74137 www.osvdb.org
- http://www.securityfocus.com/archive/1/519051/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/48915 www.securityfocus.com
- https://bugzilla.redhat.com/show_bug.cgi?id=725951 Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/68869 exchange.xforce.ibmcloud.com
- https://security.gentoo.org/glsa/201706-23 security.gentoo.org