CVE-2011-3012

CRITICAL 10.0CVE-2011-3012 · Published 09/08/2011 · updated 16/06/2026

In short

CVE-2011-3012 is a CRITICAL (CVSS 10.0) vulnerability affecting tremulous (tremulous), iourbanterror (urbanterror), world of padman (worldofpadman).
Chance of exploitation in the next 30 days (EPSS): 8.0%, higher than 94.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
tremulous tremulous	`= 1.1.0`	No fix yet
iourbanterror urbanterror	`= 2007-12-20`	No fix yet
world of padman worldofpadman	`≤ 1.2`	No fix yet

Description

The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file, a different vulnerability than CVE-2011-2764.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free