Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.6

ioquake3 can let local users replace any file

CVE-2012-3345 · published 14 years ago
Summary

Versions of ioquake3 released before r2253 let someone with access to the same computer create a special link that causes the game to overwrite any file when it writes its temporary pid file. This could be used to modify or delete important data. Upgrade to r2253 or later, or limit write permissions on the temporary folder, to stop the issue.

What to do
  • Update debian ioquake3 to version 1.36+svn2224-4.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian ioquake3 < 1.36+svn2224-4
Fix: upgrade to 1.36+svn2224-4
Debian:13 debian ioquake3 < 1.36+svn2224-4
Fix: upgrade to 1.36+svn2224-4
Debian:14 debian ioquake3 < 1.36+svn2224-4
Fix: upgrade to 1.36+svn2224-4
– ioquake3 ioquake3_engine <= r2252
cpe:2.3:a:ioquake3:ioquake3_engine:*:*:*:*:*:*:*:*
Original advisory text
ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
References
Severity
5.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published15 Jun 2012
Updated3 Nov 2026
First seen3 Sep 2026
Sources
DEBIAN-CVE-2012-3345 · OSV
CVE-2012-3345 · NVD
Track software like this
Free during beta