CVEvulnerability

CVE-2011-2764

10.0 HIGH Published 2011-08-04 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-08-04
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.

Affected configurations

• ioquake3 ioquake3 engine (<= 1.36) • ioquake3 ioquake3 engine 1.36 • openarena openarena • smokin-guns smokin\' guns • tremulous tremulous • urbanterror iourbanterror • worldofpadman world of padman

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References