GCVE - cpe:2.3:a:ioquake3:ioquake3:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ioquake3:ioquake3:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ioquake3 (`e02bf4d1-a4e3-5275-a757-4b246266c56e`)
Product	Ioquake3 (`7c149a9a-ee49-5dca-a1a7-6a30f8b12569`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ioquake3`	purl2cpe	2026-06-01 10:18:08.755561
`pkg:deb/ubuntu/ioquake3`	purl2cpe	2026-06-01 10:18:08.755564
`pkg:github/id-software/quake-iii-arena`	purl2cpe	2026-06-01 10:18:08.755567
`pkg:github/ioquake/ioq3`	purl2cpe	2026-06-01 10:18:08.755569
`pkg:rpm/opensuse/ioquake3`	purl2cpe	2026-06-01 10:18:08.755572

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-6903`	vulnerable	2026-06-08 05:09:55.133366	Details available In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape. Published: 2017-03-14T22:00:00.000Z Updated: 2024-08-05T15:41:17.741Z Open on db.gcve.eu Reference links https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998 http://www.debian.org/security/2017/dsa-3812 https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1 https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372 https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-11721`	vulnerable	2026-06-08 05:08:38.351775	Details available Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted packet. Published: 2017-08-03T08:00:00.000Z Updated: 2024-08-05T18:19:38.480Z Open on db.gcve.eu Reference links http://www.debian.org/security/2017/dsa-3941 https://github.com/ioquake/ioq3/commit/d2b1d124d4055c2fcbe5126863487c52fd58cca1 http://www.debian.org/security/2017/dsa-3948	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.