# Counter-Strike Counter-Strike 1.6 updates released

- Product: Counter-Strike (https://whatsnew.fyi/product/counter-strike)
- Vendor: Valve
- Date: 2019-04-16
- Original notes: https://store.steampowered.com/news/app/10/view/2904214312357637183
- Permalink: https://whatsnew.fyi/product/counter-strike/releases/2019-04-16-counter-strike-1.6-updates-released

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Added privilege checking to command execution so commands originating outside of the client can only execute safe commands
- **added** — Added 'cl_filterstuffcmd' setting to restrict potentially abusable commands like 'say', 'fps_max', and 'setinfo' to privileged sources when set to a value greater than zero
- **fixed** — Fixed client incorrectly blocking download of custom sprays
- **security** — Added file name safety checking for all custom resources downloaded from a server before allowing download
- **security** — Prevented invalid file extensions in several commands
- **security** — Removed dynamic library search from custom resource directories
- **security** — Added additional file extensions to custom resource blocked extensions list
- **security** — Fixed buffer overflow in message delta parsing
- **security** — Fixed remote code execution in weapon message handling
- **security** — Fixed remote code execution in model loading
- **security** — Fixed buffer overflows in TGA and BMP loading
- **security** — Fixed buffer overflow in demo playback
- **security** — Fixed buffer overflows in model name loading
- **security** — Fixed buffer overflow in detail texture loading
- **security** — Fixed buffer overflow in console map listing
- **security** — Fixed command chaining in cvars that specified config files to be passed to the 'exec' command

This list covers the releases between March 20 and April 11 that are each part of a series of security updates.

Larger changes:

-  Added privilege checking to command execution. Commands originating outside of the client are now only able to execute commands that are considered to be safe. Commands such as 'connect', 'bind', 'quit' and certain cvars such as 'cl_filterstuffcmd' are now only executable by trusted sources.

-  Setting 'cl_filterstuffcmd' to a value greater than zero (e.g. 'cl_filterstuffcmd 1') will set a number of commands that are potentially abusable, such as 'say', 'fps_max', and 'setinfo', to also be only executable by privileged sources.

Fixes:

-  Fixed client incorrectly blocking download of custom sprays

Security fixes:

-  All custom resources downloaded from a server now have their file name's checked for safety before being allowed to download

-  Invalid file extensions are now prevented in several commands

-  Dynamic libraries are no longer searched for in custom resource directories

-  Added additional file extensions to custom resource blocked extensions list

-  Fixed buffer overflow in message delta parsing

-  Fixed RCE in weapon message handling

-  Fixed RCE in model loading

-  Fixed buffer overflows in TGA and BMP loading

-  Fixed buffer overflow in demo playback

-  Fixed buffer overflows in model name loading

-  Fixed buffer overflow in detail texture loading

-  Fixed buffer overflow in console map listing

-  Fixed command chaining in cvar's that specified config files to be passed to the 'exec' command