This list covers the releases between March 20 and April 11 that are each part of a series of security updates.
Larger changes:
Added privilege checking to command execution. Commands originating outside of the client are now only able to execute commands that are considered to be safe. Commands such as 'connect', 'bind', 'quit' and certain cvars such as 'cl_filterstuffcmd' are now only executable by trusted sources.
Setting 'cl_filterstuffcmd' to a value greater than zero (e.g. 'cl_filterstuffcmd 1') will set a number of commands that are potentially abusable, such as 'say', 'fps_max', and 'setinfo', to also be only executable by privileged sources.
Fixes:
Fixed client incorrectly blocking download of custom sprays
Security fixes:
All custom resources downloaded from a server now have their file name's checked for safety before being allowed to download
Invalid file extensions are now prevented in several commands
Dynamic libraries are no longer searched for in custom resource directories
Added additional file extensions to custom resource blocked extensions list
Fixed buffer overflow in message delta parsing
Fixed RCE in weapon message handling
Fixed RCE in model loading
Fixed buffer overflows in TGA and BMP loading
Fixed buffer overflow in demo playback
Fixed buffer overflows in model name loading
Fixed buffer overflow in detail texture loading
Fixed buffer overflow in console map listing
Fixed command chaining in cvar's that specified config files to be passed to the 'exec' command
Larger changes:
Fixes:
Security fixes:
View the full article
Donator: SteamDB
Donator: SteamLadder
Steam Level Up: https://slvlup.com/r/krrna6
Steam™ Hour Boosting!: https://freehourboost.com/?r=cosminzm
https://guns.lol/cosmingl
https://gamelife.ro/buy/