CVEvulnerability
CVE-2004-0396
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-06-14
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
Affected configurations
• cvs cvs 1.11
• cvs cvs 1.12
References
- ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc ftp.NetBSD.org
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc ftp.freebsd.org
- http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html archives.neohapsis.com
- http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html cert.uni-stuttgart.de
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html lists.grok.org.uk
- http://marc.info/?l=bugtraq&m=108498454829020&w=2 marc.info
- http://marc.info/?l=bugtraq&m=108500040719512&w=2 marc.info
- http://marc.info/?l=bugtraq&m=108636445031613&w=2 marc.info
- http://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2 marc.info
- http://secunia.com/advisories/11641 secunia.com
- http://secunia.com/advisories/11647 secunia.com
- http://secunia.com/advisories/11651 secunia.com
- http://secunia.com/advisories/11652 secunia.com
- http://secunia.com/advisories/11674 secunia.com
- http://security.e-matters.de/advisories/072004.html security.e-matters.de
- http://security.gentoo.org/glsa/glsa-200405-12.xml security.gentoo.org
- http://www.ciac.org/ciac/bulletins/o-147.shtml www.ciac.org
- http://www.debian.org/security/2004/dsa-505 Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/192038 Patch, Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:048 www.mandriva.com
- http://www.osvdb.org/6305 www.osvdb.org
- http://www.redhat.com/support/errata/RHSA-2004-190.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/10384 www.securityfocus.com
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865 www.slackware.com
- http://www.us-cert.gov/cas/techalerts/TA04-147A.html US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16193 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970 oval.cisecurity.org
- ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc ftp.NetBSD.org
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc ftp.freebsd.org
- http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html archives.neohapsis.com
- http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html cert.uni-stuttgart.de
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html lists.grok.org.uk
- http://marc.info/?l=bugtraq&m=108498454829020&w=2 marc.info
- http://marc.info/?l=bugtraq&m=108500040719512&w=2 marc.info
- http://marc.info/?l=bugtraq&m=108636445031613&w=2 marc.info
- http://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2 marc.info
- http://secunia.com/advisories/11641 secunia.com
- http://secunia.com/advisories/11647 secunia.com
- http://secunia.com/advisories/11651 secunia.com
- http://secunia.com/advisories/11652 secunia.com
- http://secunia.com/advisories/11674 secunia.com
- http://security.e-matters.de/advisories/072004.html security.e-matters.de
- http://security.gentoo.org/glsa/glsa-200405-12.xml security.gentoo.org
- http://www.ciac.org/ciac/bulletins/o-147.shtml www.ciac.org
- http://www.debian.org/security/2004/dsa-505 Patch, Vendor Advisory
- http://www.kb.cert.org/vuls/id/192038 Patch, Third Party Advisory, US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:048 www.mandriva.com
- http://www.osvdb.org/6305 www.osvdb.org
- http://www.redhat.com/support/errata/RHSA-2004-190.html Patch, Vendor Advisory
- http://www.securityfocus.com/bid/10384 www.securityfocus.com
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865 www.slackware.com
- http://www.us-cert.gov/cas/techalerts/TA04-147A.html US Government Resource
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16193 exchange.xforce.ibmcloud.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9058 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A970 oval.cisecurity.org