Candidate: CVE-2017-6903
PublicDate: 2017-03-14 22:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6903
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857699
 https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd
 https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372
 https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d
 https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998
 https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1
 https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20
 https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7
 https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/
Description:
 In ioquake3 before 2017-03-14, the auto-downloading feature has
 insufficient content restrictions. This also affects Quake III Arena,
 OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks.
 A malicious auto-downloaded file can trigger loading of crafted
 auto-downloaded files as native code DLLs. A malicious auto-downloaded file
 can contain configuration defaults that override the user's. Executable
 bytecode in a malicious auto-downloaded file can set configuration
 variables to values that will result in unwanted native code DLLs being
 loaded, resulting in sandbox escape.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [7.8 HIGH]

Patches_ioquake3:
upstream_ioquake3: released (1.36+u20161101+dfsg1-2, 1.36+u20140802+gca9eebb-2+deb8u1)
precise_ioquake3: ignored (reached end-of-life)
precise/esm_ioquake3: DNE (precise was needs-triage)
trusty_ioquake3: ignored (reached end-of-life)
trusty/esm_ioquake3: DNE (trusty was needed)
vivid/stable-phone-overlay_ioquake3: DNE
vivid/ubuntu-core_ioquake3: DNE
xenial_ioquake3: ignored (end of standard support, was needed)
yakkety_ioquake3: ignored (reached end-of-life)
zesty_ioquake3: ignored (reached end-of-life)
artful_ioquake3: ignored (reached end-of-life)
bionic_ioquake3: not-affected (1.36+u20180108~dfsg-2)
cosmic_ioquake3: not-affected (1.36+u20180108~dfsg-2)
disco_ioquake3: not-affected (1.36+u20180108~dfsg-2)
eoan_ioquake3: not-affected (1.36+u20180108~dfsg-2)
focal_ioquake3: not-affected (1.36+u20180108~dfsg-2)
groovy_ioquake3: not-affected (1.36+u20180108~dfsg-2)
hirsute_ioquake3: not-affected (1.36+u20180108~dfsg-2)
impish_ioquake3: not-affected (1.36+u20180108~dfsg-2)
jammy_ioquake3: not-affected (1.36+u20180108~dfsg-2)
devel_ioquake3: not-affected (1.36+u20180108~dfsg-2)

Patches_openarena:
upstream_openarena: needs-triage
precise_openarena: ignored (reached end-of-life)
precise/esm_openarena: DNE (precise was needs-triage)
trusty_openarena: ignored (reached end-of-life)
trusty/esm_openarena: DNE (trusty was not-affected [code not present])
vivid/stable-phone-overlay_openarena: DNE
vivid/ubuntu-core_openarena: DNE
xenial_openarena: not-affected (code not present)
yakkety_openarena: ignored (reached end-of-life)
zesty_openarena: ignored (reached end-of-life)
artful_openarena: ignored (reached end-of-life)
bionic_openarena: not-affected (code not present)
cosmic_openarena: ignored (reached end-of-life)
disco_openarena: not-affected (code not present)
eoan_openarena: not-affected (code not present)
focal_openarena: not-affected (code not present)
groovy_openarena: not-affected (code not present)
hirsute_openarena: not-affected (code not present)
impish_openarena: not-affected (code not present)
jammy_openarena: not-affected (code not present)
devel_openarena: not-affected (code not present)