cvs - several vulnerabilities

Sebastian Krahmer and Stefan Esser discovered several vulnerabilities
in the CVS server, which serves the popular Concurrent Versions
System. The Common Vulnerabilities and Exposures project identifies the
following problems:

• CAN-2004-0416: double-free() in error_prog_name
• CAN-2004-0417: argument integer overflow
• CAN-2004-0418: out of bound writes in serve_notify()

For the stable distribution (woody) this problem has been fixed in
version 1.11.1p1debian-9woody7.

For the unstable distribution (sid) this problem has been fixed in
version 1.12.9-1.

We recommend that you upgrade your cvs package.