CVE-2006-2875
published 2006-06-07CVE-2006-2875: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to…
PriorityP347high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
6.65%
93.0th percentile
Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ioquake3 | < ioquake3 1.36+svn1788j-1 (bookworm) | ioquake3 1.36+svn1788j-1 (bookworm) |
| id_software | quake_3_engine | <= 1.32c | — |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
| ioquake3 | ioquake3 | >= 0 < 1.36+svn1788j-1 | 1.36+svn1788j-1 |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p83w-53w7-28fx: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1
ghsa_unreviewed·2022-05-01
CVE-2006-2875 [HIGH] GHSA-p83w-53w7-28fx: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1
Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.
OSV
CVE-2006-2875: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1
osv·2006-06-07·CVSS 7.5
CVE-2006-2875 [HIGH] CVE-2006-2875: Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1
Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.
Debian
CVE-2006-2875: ioquake3 - Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1...
vendor_debian·2006·CVSS 7.5
CVE-2006-2875 [HIGH] CVE-2006-2875: ioquake3 - Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1...
Stack-based buffer overflow in the CL_ParseDownload function of Quake 3 Engine 1.32c and earlier, as used in multiple products, allows remote attackers to execute arbitrary code via a svc_download command with compressed data that triggers the overflow during expansion.
Scope: local
bookworm: resolved (fixed in 1.36+svn1788j-1)
bullseye: resolved (fixed in 1.36+svn1788j-1)
forky: resolved (fixed in 1.36+svn1788j-1)
sid: resolved (fixed in 1.36+svn1788j-1)
trixie: resolved (fixed in 1.36+svn1788j-1)
No detection rules found.
Bugzilla
multiple flaws in current version of tremulous
bugzilla·2012-02-22·CVSS 7.5
CVE-2006-2236 [HIGH] multiple flaws in current version of tremulous
multiple flaws in current version of tremulous
According to these Debian bug reports, tremulous suffers from a number of unresolved flaws:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660827: CVE-2006-2236 ("the remapShader exploit") can lead to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660830: CVE-2006-2875 ("q3cbof") stack-based buffer overflow leading to arbitrary code execution
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660831: CVE-2006-2082 arbitrary file download from server
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660832: CVE-2006-3324 ("q3cfilevar-A") arbitrary file overwriting
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660834: CVE-2006-3325 ("q3cfilevar-B") configuration overwriting
In addition, tremulous suffers from
Bugzilla
tremulous: Multiple unfixed Quake3 engine security issues
bugzilla·2008-07-15·CVSS 7.5
CVE-2006-2236 [HIGH] tremulous: Multiple unfixed Quake3 engine security issues
tremulous: Multiple unfixed Quake3 engine security issues
Based on search started from http://bugs.gentoo.org/show_bug.cgi?id=222119 , it
seems that tremulous packages as shipped in Fedora contains multiple unfixed
security issues, that were previously addressed in Quake3:
CVE-2006-2236:
Buffer overflow in the Quake 3 Engine, as used by (1) ET 2.60, (2) Return to
Castle Wolfenstein 1.41, and (3) Quake III Arena 1.32b allows remote attackers
to execute arbitrary commands via a long remapShader command.
Quake3 fix:
http://svn.icculus.org/quake3?view=rev&revision=765
Tremulous fix:
http://svn.icculus.org/tremulous?view=rev&revision=778
References:
http://www.securityfocus.com/archive/1/archive/1/433349/100/0/threaded
http://www.milw0rm.com/exploits/1750
http://secunia.com/advisories/199
http://aluigi.altervista.org/adv/q3cbof-adv.txthttp://secunia.com/advisories/20401http://securitytracker.com/id?1016219http://www.securityfocus.com/archive/1/435963/100/0/threadedhttp://www.securityfocus.com/bid/18271http://www.vupen.com/english/advisories/2006/2129http://aluigi.altervista.org/adv/q3cbof-adv.txthttp://secunia.com/advisories/20401http://securitytracker.com/id?1016219http://www.securityfocus.com/archive/1/435963/100/0/threadedhttp://www.securityfocus.com/bid/18271http://www.vupen.com/english/advisories/2006/2129
2006-06-07
Published