CVE-2004-0180

The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405...

CVE-2004-0405

CVS before 1.11 allows CVS clients to read arbitrary files via .. dot dot sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180...

Security fix for the ALT Linux 5 package cvs version 1.11.15-alt3

May 25, 2004 Dmitry V. Levin 1.11.15-alt3 - Applied upstream fix for pserver heap overflow CAN-2004-0414...

CVE-2004-0396

CVS CVE-2004-0396 is a heap-based buffer overflow in the CVS server's pserver handling, affecting CVS feature versions 1.12.7 and earlier and 1.11.15 and earlier. The overflow occurs while processing Entry lines and can allow a remote attacker to execute arbitrary code on the CVS server. Affected...

CVE-2004-0396

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines...

CVE-2004-0396

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines...

CVS heap overflow vulnerability

Background CVS Concurrent Versions System is an open-source network-transparent version control system. It contains both a client utility and a server. Description Stefan Esser discovered a heap overflow in the CVS server, which can be triggered by sending malicious "Entry" lines and manipulating...

cvs -- numerous vulnerabilities

A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price. Insufficient input validation while processing "Entry" lines. CVE-2004-0414 A double-free resulting from erroneous state handling while processing "Argumentx" commands. CVE-2004-0416 Integer...

cvs

New cvs packages are available for Slackware 8.1, 9.0, 9.1, and -current to fix a buffer overflow vulnerability which could allow an attacker to run arbitrary programs on the CVS server. Sites running a CVS server should upgrade to the new CVS package right away. More details about this issue may...

[SECURITY] [DSA 505-1] New cvs packages fix remote exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 505-1 [email protected] http://www.debian.org/security/ Martin Schulze May 19th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 505-1] New cvs packages fix remote exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 505-1 [email protected] http://www.debian.org/security/ Martin Schulze May 19th, 2004 http://www.debian.org/security/faq -...

Critical: Red Hat Security Advisory: cvs security update

An updated cvs package that fixes a server vulnerability that could be exploited by a malicious client is now available. CVS is a version control system frequently used to manage source code repositories. Stefan Esser discovered a flaw in cvs where malformed "Entry" lines could cause a heap...

DSA-505 cvs - heap overflow

Bulletin has no description...

Advisory 07/2004: CVS remote vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: CVS remote vulnerability Release Date: 2004/05/19 Last Modified: 2004/05/19 Author: Stefan Esser [email protected] Application: CVS feature release = 1.12.7 CVS stable release =...

FreeBSD-SA-04:10.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:10.cvs Security Advisory The FreeBSD Project Topic: CVS pserver protocol parser errors Category: contrib Module: contribcvs Announced: 2004-05-19 Revised:...

CVS contains a heap overflow in the handling of flag insertion

Overview A heap overflow vulnerability in the Concurrent Versions System CVS could allow a remote attacker to execute arbitrary code on a vulnerable system. Description CVS is a source code maintenance system that is widely used by open-source software development projects. There is a heap memory...

CVS pserver Line Entry Handling Overflow

According to its version number, the remote CVS server has a heap- based buffer overflow vulnerability. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid12240;...

Security fix for the ALT Linux 5 package cvs version 1.11.15-alt2

May 10, 2004 Dmitry V. Levin 1.11.15-alt2 - Applied upstream fix for pserver heap overflow CAN-2004-0396...

cvs pserver remote heap buffer overflow

Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory. A malicious CVS client can exploit this to run arbitrary code on the server at the...

cvs security update

CVS is a client/server version control system. As a server, it is used to host source code repositories. As a client, it is used to access such repositories. This advisory affects both uses of CVS. A security problem which could allow a server to create arbitrary files on a client machine, and...