What’s Vulnerable › Vulnerabilities

CVE-2011-2764

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2011-08-04 · updated 2026-06-16
• Weakness: CWE-20

Description

The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.

Affected products

• Ioquake3 Engine: through 1.36; 1.36-rc1
• Openarena: all versions
• Smokin-Guns Smokin' Guns: all versions
• Tremulous: all versions
• Urbanterror Iourbanterror: all versions
• Worldofpadman World Of Padman: all versions

References

• http://archives.neohapsis.com/archives/fulldisclosure/2011-07/0338.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-August/063460.html
• http://secunia.com/advisories/45539
• http://secunia.com/advisories/45540
• http://securityreason.com/securityalert/8324
• http://svn.icculus.org/quake3?view=rev&revision=2098
• http://thilo.tjps.eu/download/patches/ioq3-svn-r2098.diff
• http://www.securityfocus.com/archive/1/519051/100/0/threaded
• http://www.securityfocus.com/bid/48915
• https://bugzilla.redhat.com/show_bug.cgi?id=725951
• https://exchange.xforce.ibmcloud.com/vulnerabilities/68870
• https://security.gentoo.org/glsa/201706-23

Get alerted when CVE-2011-2764 or the next vulnerability affects your stack