CVE-2007-5248

Multiple format string vulnerabilities in the ID Software Doom 3 engine, as used by Doom 3 1.3.1 and earlier, Quake 4 1.4.2 and earlier, and Prey 1.3 and earlier, when Punkbuster (PB) is enabled, allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in (1) a PB_Y packet to the YPG server or (2) a PB_U packet to UCON. NOTE: this issue might be in Punkbuster itself, but there are insufficient details to be certain.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

7.48% chance of exploitation in the next 30 days, 94th percentile

Published

2007-10-06

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://aluigi.org/poc/d3engfspb.zip

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/30630

References

• CVE Record
• NVD entry

Related

• CVE-2007-5247
• CVE-2007-5249
• CVE-2007-5246
• CVE-2007-5250
• CVE-2007-5245
• CVE-2007-5253