CVE-2004-0396
NoneCVSS
—
EPSS
67.5%
Published
Jun 14, 2004
CISA due date
—
The record
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | cvs | 0 | 1:1.12.5-6 |
| Debian:12 | cvs | 0 | 1:1.12.5-6 |
| Debian:13 | cvs | 0 | 1:1.12.5-6 |
| Debian:3.0 | cvs | 0 | 1.11.1p1debian-9woody4 |
| Red Hat:enterprise_linux:3::as | cvs | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::as | cvs-debuginfo | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::desktop | cvs | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::desktop | cvs-debuginfo | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::es | cvs | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::es | cvs-debuginfo | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::ws | cvs | 0 | 0:1.11.2-22 |
| Red Hat:enterprise_linux:3::ws | cvs-debuginfo | 0 | 0:1.11.2-22 |
Related vulnerabilities
- CVE-2017-12836 CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote… Also affects cvs
- CVE-2004-0416 Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8… Also affects cvs
- CVE-2003-0015 Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a… Also affects cvs