Published: 29/05/2012 Updated: 13/02/2023

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cvs cvs 1.11
cvs cvs 1.12

Synopsis Moderate: cvs security update Type/Severity Security Advisory: Moderate Topic Updated cvs packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerability Sco ...

cvs could be made to crash or run programs as your login if it connected to a malicious proxy server ...

It was discovered that a malicious CVS server could cause a heap overflow in the CVS client, potentially allowing the server to execute arbitrary code on the client For the stable distribution (squeeze), this problem has been fixed in version 1:11213-12+squeeze1 For the unstable distribution (sid), this problem has been fixed in version 2:112 ...

A heap-based buffer overflow flaw was found in the way the CVS client handled responses from HTTP proxies A malicious HTTP proxy could use this flaw to cause the CVS client to crash or, possibly, execute arbitrary code with the privileges of the user running the CVS client (CVE-2012-0804) ...

CWE-119 http://secunia.com/advisories/48063 http://secunia.com/advisories/48142 http://secunia.com/advisories/47869 http://lists.opensuse.org/opensuse-updates/2012-02/msg00064.html http://www.securityfocus.com/bid/51943 http://www.debian.org/security/2012/dsa-2407 http://rhn.redhat.com/errata/RHSA-2012-0321.html http://www.osvdb.org/78987 https://bugzilla.redhat.com/show_bug.cgi?id=784141 http://ubuntu.com/usn/usn-1371-1 http://secunia.com/advisories/48150 http://www.securitytracker.com/id?1026719 https://security.gentoo.org/glsa/201701-44 https://exchange.xforce.ibmcloud.com/vulnerabilities/73097 http://www.mandriva.com/security/advisories?name=MDVSA-2012:044 https://access.redhat.com/errata/RHSA-2012:0321 https://usn.ubuntu.com/1371-1/https://nvd.nist.gov

CVE-2012-0804

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect