Package: tremulous Version: 1.1.0-4.1 Severity: grave Tags: security Justification: user security hole
CVE-2006-2875 is a buffer overflow in the Quake 3 engine, originally discovered by Luigi Auriemma. Due to missing bounds-checking in CL_ParseDownload, a malicious server can cause clients connecting to it to execute arbitrary code via a network packet with compressed data. Tremulous is based on a fork of that engine, and version 1.1.0 as shipped in Debian has the same vulnerability. The de facto upstream for the Quake 3 engine is ioquake3, in which this vulnerability was fixed in r796. Debian's ioquake3 package is not vulnerable. -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
