cvs security update

2005-09-0615:56:55

CentOS Project

lists.centos.org

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

16.0%

JSON

CentOS Errata and Security Advisory CESA-2005:756

CVS (Concurrent Version System) is a version control system.

An insecure temporary file usage was found in the cvsbug program. It is
possible that a local user could leverage this issue to execute arbitrary
instructions as the user running cvsbug. The Common Vulnerabilities and
Exposures project assigned the name CAN-2005-2693 to this issue.

All users of cvs should upgrade to this updated package, which includes a
patch to correct this issue.

Affected packages:
cvs

Upstream details at:
https://access.redhat.com/errata/RHSA-2005:756

OSVersionArchitecturePackageVersionFilename
CentOS3i386cvs< 1.11.2-28cvs-1.11.2-28.i386.rpm
CentOS3x86_64cvs< 1.11.2-28cvs-1.11.2-28.x86_64.rpm
CentOS4x86_64cvs< 1.11.17-8.RHEL4cvs-1.11.17-8.RHEL4.x86_64.rpm
CentOS4i386cvs< 1.11.17-8.RHEL4cvs-1.11.17-8.RHEL4.i386.rpm
CentOS4ia64cvs< 1.11.17-8.RHEL4cvs-1.11.17-8.RHEL4.ia64.rpm
CentOS3ia64cvs< 1.11.2-28cvs-1.11.2-28.ia64.rpm
CentOS3s390cvs< 1.11.2-28cvs-1.11.2-28.s390.rpm
CentOS3s390xcvs< 1.11.2-28cvs-1.11.2-28.s390x.rpm
CentOS4s390cvs< 1.11.17-8.RHEL4cvs-1.11.17-8.RHEL4.s390.rpm
CentOS4s390xcvs< 1.11.17-8.RHEL4cvs-1.11.17-8.RHEL4.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	cvs	< 1.11.2-28	cvs-1.11.2-28.i386.rpm
CentOS	3	x86_64	cvs	< 1.11.2-28	cvs-1.11.2-28.x86_64.rpm
CentOS	4	x86_64	cvs	< 1.11.17-8.RHEL4	cvs-1.11.17-8.RHEL4.x86_64.rpm
CentOS	4	i386	cvs	< 1.11.17-8.RHEL4	cvs-1.11.17-8.RHEL4.i386.rpm
CentOS	4	ia64	cvs	< 1.11.17-8.RHEL4	cvs-1.11.17-8.RHEL4.ia64.rpm
CentOS	3	ia64	cvs	< 1.11.2-28	cvs-1.11.2-28.ia64.rpm
CentOS	3	s390	cvs	< 1.11.2-28	cvs-1.11.2-28.s390.rpm
CentOS	3	s390x	cvs	< 1.11.2-28	cvs-1.11.2-28.s390x.rpm
CentOS	4	s390	cvs	< 1.11.17-8.RHEL4	cvs-1.11.17-8.RHEL4.s390.rpm
CentOS	4	s390x	cvs	< 1.11.17-8.RHEL4	cvs-1.11.17-8.RHEL4.s390x.rpm