cvs - heap overflow

Stefan Esser discovered a heap overflow in the CVS server, which
serves the popular Concurrent Versions System. Malformed “Entry”
Lines in combination with Is-modified and Unchanged can be used to
overflow malloc()ed memory. This was proven to be exploitable.

For the stable distribution (woody) this problem has been fixed in
version 1.11.1p1debian-9woody4.

For the unstable distribution (sid) this problem has been fixed in
version 1.12.5-6.

We recommend that you upgrade your cvs package immediately.