Secunia

A vulnerability has been reported in the Icculus.org Quake 3 Engine, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a user's system.

A boundary error exists in the handling of CS_ITEMS sent from a server. This can be exploited to cause a stack-based buffer overflow by sending overly long values to the client.

Successful exploitation may allow arbitrary code execution, but requires that the user is e.g. tricked into connecting to a malicious server.

The vulnerability has been reported in revision 812. Prior versions may be also affected.

Solution
The vulnerability has been fixed in revision 813 in the SVN repository.

Provided and/or discovered by
Originally discovered in Quake engine by:
RunningBon

Reported in Icculus.org Quake 3 Engine by:
Luigi Auriemma

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area