CVE-2007-5248
- State
- Published
- Severity
- Not scored
- Published
- Oct 6, 2007
- Updated
- Aug 7, 2024
- Reserved
- Oct 6, 2007
Description
Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and Prey 1.3 and earlier, when Punkbuster (PB) is enabled, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server or (2) a PB_U packet to UCON. NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 27023third-party-advisory
- 27002third-party-advisory
- doom3engine-punkbuster-format-string(36899)vdb-entry
- ADV-2007-3333vdb-entry
- 27036third-party-advisory
- http://aluigi.altervista.org/adv/d3engfspb-adv.txt
- 25893vdb-entry
- http://aluigi.org/poc/d3engfspb.zip
- 20071001 Format string in the Doom 3 engine through PBmailing-list
- 3196third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.