Published: 06/08/2004 Updated: 03/05/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

CVS 1.12.x up to and including 1.12.8, and 1.11.x up to and including 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cvs cvs 1.11.14
cvs cvs 1.11.15
cvs cvs 1.12.1
cvs cvs 1.12.2
sgi propack 2.4
sgi propack 3.0
cvs cvs 1.11
cvs cvs 1.11.1
cvs cvs 1.11.1_p1
cvs cvs 1.11.3
cvs cvs 1.11.4
cvs cvs 1.12.8
openpkg openpkg
cvs cvs 1.10.7
cvs cvs 1.10.8
cvs cvs 1.11.16
cvs cvs 1.11.2
cvs cvs 1.12.5
cvs cvs 1.12.7
cvs cvs 1.11.10
cvs cvs 1.11.11
cvs cvs 1.11.5
cvs cvs 1.11.6
openpkg openpkg 1.3
openpkg openpkg 2.0
openbsd openbsd 3.4
openbsd openbsd 3.5
gentoo linux 1.4
openbsd openbsd

Synopsis cvs security update Type/Severity Security Advisory: Critical Topic An updated cvs package that fixes several server vulnerabilities, which couldbe exploited by a malicious client, is now available Description CVS is a version control system frequently used to manage source codere ...

Derek Robert Price discovered a potential buffer overflow vulnerability in the CVS server, based on a malformed Entry, which serves the popular Concurrent Versions System For the stable distribution (woody) this problem has been fixed in version 1111p1debian-9woody6 For the unstable distribution (sid) this problem has been fixed in version 112 ...

NVD-CWE-Other http://security.gentoo.org/glsa/glsa-200406-06.xml http://www.debian.org/security/2004/dsa-517 http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html http://security.e-matters.de/advisories/092004.html http://www.redhat.com/support/errata/RHSA-2004-233.html ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc http://www.mandriva.com/security/advisories?name=MDKSA-2004:058 http://marc.info/?l=bugtraq&m=108716553923643&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A993 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10575 https://access.redhat.com/errata/RHSA-2004:233 https://nvd.nist.gov https://www.debian.org/security/./dsa-517

CVE-2004-0414

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect