CVE-2011-2764

N/A Unknown
Published: August 04, 2011 Modified: April 29, 2026
View on NVD

Description

The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html
Source: cve@mitre.org
Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
Source: cve@mitre.org
http://secunia.com/advisories/45539
Source: cve@mitre.org
http://secunia.com/advisories/45540
Source: cve@mitre.org
http://securityreason.com/securityalert/8324
Source: cve@mitre.org
http://svn.icculus.org/quake3?view=rev&revision=2098
Source: cve@mitre.org
Patch
http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff
Source: cve@mitre.org
Patch
http://www.securityfocus.com/archive/1/519051/100/0/threaded
Source: cve@mitre.org
http://www.securityfocus.com/bid/48915
Source: cve@mitre.org
https://bugzilla.redhat.com/show_bug.cgi?id=725951
Source: cve@mitre.org
Exploit Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/68870
Source: cve@mitre.org
https://security.gentoo.org/glsa/201706-23
Source: cve@mitre.org
http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/45539
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/45540
Source: af854a3a-2127-422b-91ae-364da2661108
http://securityreason.com/securityalert/8324
Source: af854a3a-2127-422b-91ae-364da2661108
http://svn.icculus.org/quake3?view=rev&revision=2098
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://www.securityfocus.com/archive/1/519051/100/0/threaded
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/48915
Source: af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.redhat.com/show_bug.cgi?id=725951
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/68870
Source: af854a3a-2127-422b-91ae-364da2661108
https://security.gentoo.org/glsa/201706-23
Source: af854a3a-2127-422b-91ae-364da2661108

24 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
8.7%
94th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

worldofpadman openarena ioquake3 smokin-guns urbanterror tremulous

Related CVEs

CVE-2026-56414 7.2
CVE-2026-55975 7.2
CVE-2026-33560 7.1
CVE-2026-31928 8.1
CVE-2026-28701 9.8