CVE-2004-0414

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service crash, modification of critical program data, or arbitrary code execution...

CVE-2004-0417

Integer overflow in the "Max-dotdot" CVS protocol command servemaxdotdot for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space...

CVE-2004-0418

servenotify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data...

CVE-2004-0416

Double free vulnerability for the errorprogname string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code...

CVE-2004-0417

Integer overflow in the "Max-dotdot" CVS protocol command servemaxdotdot for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space...

CVE-2004-0418

servenotify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data...

CVE-2004-0414

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service crash, modification of critical program data, or arbitrary code execution...

CVE-2004-0416

Double free vulnerability for the errorprogname string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code...

CVE-2004-0417

Integer overflow in the "Max-dotdot" CVS protocol command servemaxdotdot for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space...

CVE-2004-0416

Double free vulnerability for the errorprogname string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code...

Mandrake Linux Security Advisory : cvs (MDKSA-2004:048)

Stefan Esser discovered that malformed 'Entry' lines in combination with Is-modified and Unchanged can be used to overflow malloced memory in a way that can be remotely exploited. The updated packages contain a patch to correct the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : cvs (MDKSA-2004:058)

Another vulnerability was discovered related to 'Entry' lines in cvs, by the development team CVE-2004-0414. As well, Stefan Esser and Sebastian Krahmer performed an audit on the cvs source code and discovered a number of other problems, including : A double-free condition in the server code is...

Mandrake Linux Security Advisory : cvs (MDKSA-2004:028)

Sebastian Krahmer from the SUSE security team discovered a remotely exploitable vulnerability in the CVS client. When doing a cvs checkout or update over a network, the client accepts absolute pathnames in the RCS diff files. A maliciously configured server could then create any file with content...

Mandrake Linux Security Advisory : cvs (MDKSA-2003:112-1)

A vulnerability was discovered in the CVS server 1.11.10 where a malformed module request could cause the CVS server to attempt to create directories and possibly files at the root of the filesystem holding the CVS repository. Updated packages are available that fix the vulnerability by providing...

Mandrake Linux Security Advisory : cvs (MDKSA-2003:009)

Two vulnerabilities were discoverd by Stefen Esser in the cvs program. The first is an exploitable double free bug within the server, which can be used to execute arbitrary code on the CVS server. To accomplish this, the attacker must have an anonymous read-only login to the CVS server. The secon...

Horde Chora Software Detection

The remote host is running Chora, a PHP-based interface to CVS repositories from the Horde Project. This script was written by George A. Theall, . See the Nessus Scripts License for details. include"compat.inc"; if description scriptid13849; scriptversion"1.26";...

SuSE-SA:2004:015: cvs

The remote host is missing the patch for the advisory SuSE-SA:2004:015 cvs. The Concurrent Versions System CVS offers tools which allow developers to share and maintain large software projects. Various remotely exploitable conditions have been found during a source code review of CVS done by Stef...

SUSE-SA:2003:0007: cvs

The remote host is missing the patch for the advisory SUSE-SA:2003:0007 cvs. CVS Concurrent Versions System is a version control system which helps to manage concurrent editing of files by various authors. Stefan Esser of e-matters reported a 'double free' bug in CVS server code for handling...

SuSE-SA:2004:008: cvs

The remote host is missing the patch for the advisory SuSE-SA:2004:008 cvs. The Concurrent Versions System CVS offers tools which allow developers to share and maintain large software projects. During the analyzation of the CVS protocol and their implementation, the SuSE Security Team discovered ...

SuSE-SA:2004:013: cvs

The remote host is missing the patch for the advisory SuSE-SA:2004:013 cvs. The Concurrent Versions System CVS offers tools which allow developers to share and maintain large software projects. Stefan Esser reported buffer overflow conditions within the cvs program. They allow remote attackers to...