Published: 07/02/2003 Updated: 03/05/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Double-free vulnerability in CVS 1.11.4 and previous versions allows remote malicious users to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freebsd freebsd 4.4
freebsd freebsd 4.5
freebsd freebsd 4.6
freebsd freebsd 4.7
freebsd freebsd 5.0
cvs cvs 1.11.1
cvs cvs 1.11.1p1
cvs cvs 1.10.8
cvs cvs 1.11
cvs cvs 1.11.2
cvs cvs 1.11.3
cvs cvs 1.10.7
cvs cvs 1.11.4

Stefan Esser discovered a problem in cvs, a concurrent versions system, which is used for many Free Software projects The current version contains a flaw that can be used by a remote attacker to execute arbitrary code on the CVS server under the user id the CVS server runs as Anonymous read-only access is sufficient to exploit this problem For t ...

source: wwwsecurityfocuscom/bid/6650/info CVS is prone to a double free vulnerability in the Directory requests An attacker may potentially take advantage of this issue to cause heap memory to be corrupted with attacker-supplied values, which may result in execution of arbitrary code githubcom/offensive-security/exploitdb-bin- ...

CWE-415 http://security.e-matters.de/advisories/012003.html http://rhn.redhat.com/errata/RHSA-2003-013.html http://www.kb.cert.org/vuls/id/650937 http://ccvs.cvshome.org/servlets/NewsItemView?newsID=51&JServSessionIdservlets=5of2iuhr14 http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0028.html http://www.cert.org/advisories/CA-2003-02.html http://www.debian.org/security/2003/dsa-233 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:009 http://www.redhat.com/support/errata/RHSA-2003-012.html http://www.ciac.org/ciac/bulletins/n-032.shtml http://www.securityfocus.com/bid/6650 http://marc.info/?l=bugtraq&m=104438807203491&w=2 http://marc.info/?l=bugtraq&m=104342550612736&w=2 http://marc.info/?l=bugtraq&m=104428571204468&w=2 http://marc.info/?l=bugtraq&m=104333092200589&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/11108 https://nvd.nist.gov https://www.debian.org/security/./dsa-233 https://www.exploit-db.com/exploits/22187/https://www.kb.cert.org/vuls/id/650937

CVE-2003-0015

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect