High
Security advisory
In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-6903
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:26 UTC · Revision 1
Source evidence
In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.
osv:CVE-2017-6903
Complete source record
{
"id": "3b7067ed8626f703077b09ef2f7f1683a6db80ba528a546275e12fcef6cd525d",
"url": "https://osv.dev/vulnerability/CVE-2017-6903",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-6903",
"summary": "In ioquake3 before 2017-03-14, the auto-downloading feature has insufficient content restrictions. This also affects Quake III Arena, OpenArena, OpenJK, iortcw, and other id Tech 3 (aka Quake 3 engine) forks. A malicious auto-downloaded file can trigger loading of crafted auto-downloaded files as native code DLLs. A malicious auto-downloaded file can contain configuration defaults that override the user's. Executable bytecode in a malicious auto-downloaded file can set configuration variables to values that will result in unwanted native code DLLs being loaded, resulting in sandbox escape.",
"evidence": "osv:CVE-2017-6903",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-6903",
"aliases": [
"CVE-2017-6903"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ioquake/ioq3",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "376267d534476a875d8b9228149c4ee18b74a4fd"
},
{
"fixed": "b173ac05993f634a42be3d3535e1b158de0c3372"
},
{
"fixed": "f61fe5f6a0419ef4a88d46a128052f2e8352e85d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "376267d534476a875d8b9228149c4ee18b74a4fd"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b173ac05993f634a42be3d3535e1b158de0c3372"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "f61fe5f6a0419ef4a88d46a128052f2e8352e85d"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6903.json",
"vanir_signatures": [
{
"id": "CVE-2017-6903-2b2bff99",
"digest": {
"length": 828,
"function_hash": "93675047476134076364831534568477298939"
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/sys/sys_main.c",
"function": "Sys_LoadDll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-3ce85af9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"126578339187641909699610824582341164057",
"171172432515240510232256132159633942053",
"202940276023208095553930184803427253114",
"23322319702966846508829072031980377605",
"307537267813294417451352173827032774415",
"216686619176242074302002024282645070635",
"251027168546510552005134463149247823818",
"292243956832168556530953349001200054380"
]
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/client/cl_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-4e21c8fd",
"digest": {
"length": 1407,
"function_hash": "156860816226980721641307891143913561275"
},
"source": "https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372",
"target": {
"file": "code/client/cl_console.c",
"function": "Con_Dump_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-694a0a3e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"4809882800629526839772819942684345287",
"281660927999886755969672318878808367578",
"213960479562293650411691124277694515446"
]
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/sys/sys_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-6b5183f0",
"digest": {
"length": 2925,
"function_hash": "37249410674601877202048732459561143207"
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/client/cl_main.c",
"function": "CL_InitRef"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-87298127",
"digest": {
"threshold": 0.9,
"line_hashes": [
"202551803697669383353911088030735331556",
"32869259132284186141470036419604106356",
"294795087076151396448802632159819089603",
"151573063802375801330180507798636270908",
"328149801008414834742403513929897014983",
"141578027635297550643040624981534825840"
]
},
"source": "https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d",
"target": {
"file": "code/client/snd_openal.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-8bd2b537",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11267719413432335363271595654432564404",
"31328713115138281736226681247582286830",
"206104564493140232267032650264534885816"
]
},
"source": "https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372",
"target": {
"file": "code/qcommon/common.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-a8a36c29",
"digest": {
"length": 295,
"function_hash": "102106852092796082823630961794882067462"
},
"source": "https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372",
"target": {
"file": "code/qcommon/common.c",
"function": "Com_WriteConfig_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-b78cdc68",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243934222013860946821851271377876121594",
"142397883805406087165485023436852016487",
"164107012220098731528888674720765307991"
]
},
"source": "https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372",
"target": {
"file": "code/client/cl_console.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-c7c1b3e6",
"digest": {
"length": 6002,
"function_hash": "303965804422126025456925044375939568659"
},
"source": "https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d",
"target": {
"file": "code/client/snd_openal.c",
"function": "S_AL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-d2288c0e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"60962053430664049257320901215016840890",
"97376908373937792748208466610628898758",
"234568798636102268738341845862388629119",
"307064807065911141683089286870069943502",
"152712665099883158432954791793024540082",
"289178849914208336998204782652826548004",
"151039376975264012224099835735853561142",
"334337463911085130048427159251641887411"
]
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/qcommon/files.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-d752b149",
"digest": {
"length": 570,
"function_hash": "46193990519959768262596960280960233250"
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/qcommon/files.c",
"function": "FS_FOpenFileRead"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-f160b94e",
"digest": {
"length": 8009,
"function_hash": "115145299544607205459214636943206186176"
},
"source": "https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"target": {
"file": "code/client/cl_main.c",
"function": "CL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:32:34Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/iortcw/iortcw",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "11a83410153756ae350a82ed41b08d128ff7f998"
},
{
"fixed": "b248763e4878ef12d5835ece6600be8334f67da1"
},
{
"fixed": "b6ff2bcb1e4e6976d61e316175c6d7c99860fe20"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "11a83410153756ae350a82ed41b08d128ff7f998"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b248763e4878ef12d5835ece6600be8334f67da1"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "b6ff2bcb1e4e6976d61e316175c6d7c99860fe20"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.42d",
"1.5a"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6903.json",
"vanir_signatures": [
{
"id": "CVE-2017-6903-11f9c503",
"digest": {
"length": 828,
"function_hash": "93675047476134076364831534568477298939"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/sys/sys_main.c",
"function": "Sys_LoadDll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-13116082",
"digest": {
"length": 2970,
"function_hash": "18595888453483369336730641851162746541"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/client/cl_main.c",
"function": "CL_InitRef"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-13e748b6",
"digest": {
"length": 828,
"function_hash": "93675047476134076364831534568477298939"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/sys/sys_main.c",
"function": "Sys_LoadDll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-19e95511",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11267719413432335363271595654432564404",
"31328713115138281736226681247582286830",
"206104564493140232267032650264534885816"
]
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "SP/code/qcommon/common.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-25f7d164",
"digest": {
"length": 6436,
"function_hash": "12665825496278496001697592447363988327"
},
"source": "https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1",
"target": {
"file": "MP/code/client/snd_openal.c",
"function": "S_AL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-30978732",
"digest": {
"length": 570,
"function_hash": "46193990519959768262596960280960233250"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/qcommon/files.c",
"function": "FS_FOpenFileRead"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-3744a096",
"digest": {
"length": 570,
"function_hash": "46193990519959768262596960280960233250"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/qcommon/files.c",
"function": "FS_FOpenFileRead"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-3ccc4f87",
"digest": {
"threshold": 0.9,
"line_hashes": [
"60962053430664049257320901215016840890",
"97376908373937792748208466610628898758",
"234568798636102268738341845862388629119",
"307064807065911141683089286870069943502",
"152712665099883158432954791793024540082",
"289178849914208336998204782652826548004",
"151039376975264012224099835735853561142",
"334337463911085130048427159251641887411"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/qcommon/files.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-43dba6b1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115926591679818466749286464994828539480",
"167938031956874717882083391031177707257",
"136951545533750772726359972848273450174",
"43051145435436789540253373702996341140",
"307537267813294417451352173827032774415",
"216686619176242074302002024282645070635",
"210918544933143290390968310625680067047",
"233007833463812082668048994078672058902"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/client/cl_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-543eda10",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19633428070034283009206437625658445847",
"4809882800629526839772819942684345287",
"281660927999886755969672318878808367578",
"213960479562293650411691124277694515446"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/sys/sys_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-59bdaa0d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"19633428070034283009206437625658445847",
"4809882800629526839772819942684345287",
"281660927999886755969672318878808367578",
"213960479562293650411691124277694515446"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/sys/sys_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-68f7b966",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153005710788924957733681144061288071052",
"302805141574075352971042268725053876426",
"213850390942288052909835382823924583172",
"151573063802375801330180507798636270908",
"328149801008414834742403513929897014983",
"166169632854469795584750288200604473411"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1",
"target": {
"file": "SP/code/client/snd_openal.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-6c5d7c04",
"digest": {
"length": 295,
"function_hash": "102106852092796082823630961794882067462"
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "SP/code/qcommon/common.c",
"function": "Com_WriteConfig_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-702cc34b",
"digest": {
"length": 295,
"function_hash": "102106852092796082823630961794882067462"
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "MP/code/qcommon/common.c",
"function": "Com_WriteConfig_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-7061625f",
"digest": {
"length": 1423,
"function_hash": "191124693343110328133250578177586093511"
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "MP/code/client/cl_console.c",
"function": "Con_Dump_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-7ee202d6",
"digest": {
"length": 2857,
"function_hash": "67171222496301802524335014287916900447"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/client/cl_main.c",
"function": "CL_InitRef"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-7ff0138d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243934222013860946821851271377876121594",
"59714264445407122880871326902413788602",
"213324151022431737454776151203871423102"
]
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "MP/code/client/cl_console.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-85c17cd4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"60962053430664049257320901215016840890",
"97376908373937792748208466610628898758",
"234568798636102268738341845862388629119",
"307064807065911141683089286870069943502",
"152712665099883158432954791793024540082",
"289178849914208336998204782652826548004",
"151039376975264012224099835735853561142",
"334337463911085130048427159251641887411"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/qcommon/files.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-8f8d35fd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11267719413432335363271595654432564404",
"31328713115138281736226681247582286830",
"206104564493140232267032650264534885816"
]
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "MP/code/qcommon/common.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-9a010196",
"digest": {
"threshold": 0.9,
"line_hashes": [
"202551803697669383353911088030735331556",
"32869259132284186141470036419604106356",
"294795087076151396448802632159819089603",
"151573063802375801330180507798636270908",
"328149801008414834742403513929897014983",
"166169632854469795584750288200604473411"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1",
"target": {
"file": "MP/code/client/snd_openal.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-9d624fbc",
"digest": {
"length": 1423,
"function_hash": "191124693343110328133250578177586093511"
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "SP/code/client/cl_console.c",
"function": "Con_Dump_f"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-a480fd5c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"115926591679818466749286464994828539480",
"150854241265398338829164048954433711094",
"303515347854323718101494044671120614708",
"100966297968684446243693944368423536009",
"304208183761566115129818162031321784121",
"310916976811811097439792852258098114922",
"280235750624441976121121883493711832195",
"45102019238841124685027780552008585855"
]
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/client/cl_main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-c5931cac",
"digest": {
"length": 6680,
"function_hash": "121945548456111027946606045229418277047"
},
"source": "https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1",
"target": {
"file": "SP/code/client/snd_openal.c",
"function": "S_AL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-c6db44fa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"243934222013860946821851271377876121594",
"59714264445407122880871326902413788602",
"213324151022431737454776151203871423102"
]
},
"source": "https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"target": {
"file": "SP/code/client/cl_console.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-cdf49a58",
"digest": {
"length": 8475,
"function_hash": "127670329632059352583009365042854650231"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "SP/code/client/cl_main.c",
"function": "CL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-d6e1e380",
"digest": {
"length": 10856,
"function_hash": "11947503431391442633203893015427610089"
},
"source": "https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20",
"target": {
"file": "MP/code/client/cl_main.c",
"function": "CL_Init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:32:34Z"
}
},
{
"ranges": [
{
"repo": "https://github.com/jacoders/openjk",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-6903.json",
"vanir_signatures": [
{
"id": "CVE-2017-6903-10fe7e30",
"digest": {
"threshold": 0.9,
"line_hashes": [
"176362247248493069422101516371169951570",
"267743225602174175210512269135232414219",
"149484764009180056304798543936734922627",
"112841397247012668160545621642561799636"
]
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "code/client/cl_main.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-2a854892",
"digest": {
"length": 3929,
"function_hash": "21717297228256682207168278021669653075"
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "code/qcommon/files.cpp",
"function": "FS_FOpenFileRead"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-2b2a9b34",
"digest": {
"length": 4183,
"function_hash": "171830328816457079678893941363564908891"
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "codemp/client/cl_main.cpp",
"function": "CL_InitRef"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-4a11f7de",
"digest": {
"length": 6018,
"function_hash": "228464392829941795499046325725772817366"
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "codemp/qcommon/files.cpp",
"function": "FS_FOpenFileRead"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-5207caa8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"76972429868907647277322864546424387787",
"135900126143763696843836366225127710621",
"84169591344931215290542809132917999758",
"305410307407996548726190620213737600060"
]
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "codemp/client/cl_main.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-53fe70a0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"230702606391216961425893672221132859074",
"48004005832872369478089860808665847304",
"275361879548646342632536387300084247853",
"164459692824696009525816482141557980916",
"114236728334692188271241945888429475181",
"149223279290409101457464800093122008963",
"176649776652894245216153619615637937906",
"226259492753484702418955351779669077678",
"184604716061794457271090405309916149257",
"101358975300933600782668063351135413135"
]
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "code/qcommon/files.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-5d82717e",
"digest": {
"length": 3524,
"function_hash": "150614883363422383749233276026177610561"
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "code/client/cl_main.cpp",
"function": "CL_InitRef"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-8811d578",
"digest": {
"threshold": 0.9,
"line_hashes": [
"108233028480356438228347252172072792281",
"164005218921620612686061964053405067848",
"264354895932889420101670009641660818263",
"85465224602989743850470928772669214363",
"164459692824696009525816482141557980916",
"114236728334692188271241945888429475181",
"149223279290409101457464800093122008963",
"52808737768768176148949751824536742319",
"74956647732786126897531562992224477743",
"105583015490116811426482440640445579536"
]
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "codemp/qcommon/files.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-9e4d9b1c",
"digest": {
"length": 852,
"function_hash": "307517336859937888752193736013725350359"
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "shared/sys/sys_main.cpp",
"function": "Sys_LoadDll"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-6903-eba60622",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94429772185782561203352939928102960614",
"36371185016152582182070514150874148734",
"244888153760604982882309629231966010684"
]
},
"source": "https://github.com/jacoders/openjk/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"target": {
"file": "shared/sys/sys_main.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:32:34Z"
}
}
],
"modified": "2026-10-20T13:32:34.800869430Z",
"provider": "osv",
"references": [
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=857699",
"https://ioquake3.org/2017/03/13/important-security-update-please-update-ioquake3-immediately/",
"https://github.com/JACoders/OpenJK/commit/8956a35e7b91c4a0dd1fa6db1d28c7f0efbab2d7",
"https://github.com/ioquake/ioq3/commit/376267d534476a875d8b9228149c4ee18b74a4fd",
"https://github.com/ioquake/ioq3/commit/b173ac05993f634a42be3d3535e1b158de0c3372",
"https://github.com/ioquake/ioq3/commit/f61fe5f6a0419ef4a88d46a128052f2e8352e85d",
"https://github.com/iortcw/iortcw/commit/11a83410153756ae350a82ed41b08d128ff7f998",
"https://github.com/iortcw/iortcw/commit/b248763e4878ef12d5835ece6600be8334f67da1",
"https://github.com/iortcw/iortcw/commit/b6ff2bcb1e4e6976d61e316175c6d7c99860fe20"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:ioquake3:ioquake3:*:*:*:*:*:*:*:*"
],
"vendor_product": "ioquake3:ioquake3",
"extracted_events": [
{
"range": [
{
"last_affected": "2017-02-27"
}
],
"source": "CPE_RANGE"
}
]
},
{
"extracted_events": [
{
"range": [
{
"introduced": "3"
},
{
"fixed": "2017-03-14"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-6903",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387799,
"published_at": "2017-03-14T22:59:01.257+00:00"
}