CVE-2004-0396

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines...

CVE-2004-0396: Undefined Security Weakness

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines...

CVS heap overflow vulnerability

Background CVS Concurrent Versions System is an open-source network-transparent version control system. It contains both a client utility and a server. Description Stefan Esser discovered a heap overflow in the CVS server, which can be triggered by sending malicious "Entry" lines and manipulating...

cvs -- numerous vulnerabilities

A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price. Insufficient input validation while processing "Entry" lines. CVE-2004-0414 A double-free resulting from erroneous state handling while processing "Argumentx" commands. CVE-2004-0416 Integer...

cvs

New cvs packages are available for Slackware 8.1, 9.0, 9.1, and -current to fix a buffer overflow vulnerability which could allow an attacker to run arbitrary programs on the CVS server. Sites running a CVS server should upgrade to the new CVS package right away. More details about this issue may...

[SECURITY] [DSA 505-1] New cvs packages fix remote exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 505-1 [email protected] http://www.debian.org/security/ Martin Schulze May 19th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 505-1] New cvs packages fix remote exploit

-------------------------------------------------------------------------- Debian Security Advisory DSA 505-1 [email protected] http://www.debian.org/security/ Martin Schulze May 19th, 2004 http://www.debian.org/security/faq -...

Critical: Red Hat Security Advisory: cvs security update

An updated cvs package that fixes a server vulnerability that could be exploited by a malicious client is now available. CVS is a version control system frequently used to manage source code repositories. Stefan Esser discovered a flaw in cvs where malformed "Entry" lines could cause a heap...

DSA-505 cvs - heap overflow

Bulletin has no description...

Advisory 07/2004: CVS remote vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: CVS remote vulnerability Release Date: 2004/05/19 Last Modified: 2004/05/19 Author: Stefan Esser [email protected] Application: CVS feature release = 1.12.7 CVS stable release =...

FreeBSD-SA-04:10.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-04:10.cvs Security Advisory The FreeBSD Project Topic: CVS pserver protocol parser errors Category: contrib Module: contribcvs Announced: 2004-05-19 Revised:...

CVS contains a heap overflow in the handling of flag insertion

Overview A heap overflow vulnerability in the Concurrent Versions System CVS could allow a remote attacker to execute arbitrary code on a vulnerable system. Description CVS is a source code maintenance system that is widely used by open-source software development projects. There is a heap memory...

CVS pserver Line Entry Handling Overflow

According to its version number, the remote CVS server has a heap- based buffer overflow vulnerability. A remote attacker could exploit this to crash the service, or possibly execute arbitrary code. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid12240;...

Security fix for the ALT Linux 5 package cvs version 1.11.15-alt2

May 10, 2004 Dmitry V. Levin 1.11.15-alt2 - Applied upstream fix for pserver heap overflow CAN-2004-0396...

cvs pserver remote heap buffer overflow

Due to a programming error in code used to parse data received from the client, malformed data can cause a heap buffer to overflow, allowing the client to overwrite arbitrary portions of the server's memory. A malicious CVS client can exploit this to run arbitrary code on the server at the...

cvs security update

CVS is a client/server version control system. As a server, it is used to host source code repositories. As a client, it is used to access such repositories. This advisory affects both uses of CVS. A security problem which could allow a server to create arbitrary files on a client machine, and...

CVE-2004-0405

CVE-2004-0405 and related CVEs affect CVS up to version 1.11.x. The Debian/Mandrake/Gentoo/Nessus advisories describe two issues: (1) CVS pserver can be abused to view files outside the repository root by using relative pathnames containing ‘..’ (CVE-2004-0405); (2) CVS servers/clients can simila...

CVE-2004-0405

CVS before 1.11 allows CVS clients to read arbitrary files via .. dot dot sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180...

CVE-2004-0405

CVS before 1.11 allows CVS clients to read arbitrary files via .. dot dot sequences in filenames via CVS client requests, a different vulnerability than CVE-2004-0180...

[SECURITY] [DSA 486-1] New cvs packages fix multiple vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 486-1 [email protected] http://www.debian.org/security/ Matt Zimmerman April 16th, 2004 http://www.debian.org/security/faq -...