Bug#660830: tremulous: CVE-2006-2875 ("q3cbof") stack-based buffer overflow leading to arbitrary code execution

[Simon McVittie]

Package: tremulous
Version: 1.1.0-4.1
Severity: grave
Tags: security
Justification: user security hole

CVE-2006-2875 is a buffer overflow in the Quake 3 engine, originally
discovered by Luigi Auriemma. Due to missing bounds-checking in
CL_ParseDownload, a malicious server can cause clients connecting to it
to execute arbitrary code via a network packet with compressed data.

Tremulous is based on a fork of that engine, and version 1.1.0 as shipped
in Debian has the same vulnerability.

The de facto upstream for the Quake 3 engine is ioquake3, in which this
vulnerability was fixed in r796. Debian's ioquake3 package is not vulnerable.