CVE-2003-0155

CVE-2003-0155 affects bonsai, the Mozilla CVS query tool. It allows remote attackers to access the parameters page without authentication, exposing configuration parameters. CVSS v2 base score is 5.0 (medium) with Network attack vector, low attack complexity, no authentication required, and parti...

CVE-2003-0152

CVE-2003-0152 concerns the Bonsai Mozilla CVS query tool CGI, allowing remote execution of arbitrary commands as www-data. Public records (Debian DSA-265) show fixes in Bonsai updates (e.g., bonsai 1.3+cvs20020224-1woody1 for woody; later fixes for sid). OpenVAS/Nessus entries corroborate multipl...

CVE-2003-0153

bonsai Mozilla CVS query tool leaks the absolute pathname of the tool in certain error messages generated by 1 cvslog.cgi, 2 cvsview2.cgi, or 3 multidiff.cgi...

CVE-2003-0154

Cross-site scripting vulnerabilities XSS in bonsai Mozilla CVS query tool allow remote attackers to execute arbitrary web script via 1 the file, root, or rev parameters to cvslog.cgi, 2 the file or root parameters to cvsblame.cgi, 3 various parameters to cvsquery.cgi, 4 the person parameter to...

CVS Malformed Directory Request Double-free Privilege Escalation

According to its version number, the CVS server running on the remote host has a double free bug, which could allow a malicious user to elevate their privileges. C Tenable Network Security, Inc. include"compat.inc"; References: From: Stefan Esser Subject: Advisory 01/2003: CVS remote vulnerabilit...

CVS pserver Brute Force Access

It was possible to find the public CVS repository of the remote host by searching a list of commonly used passwords and CVS repositories. A remote attacker could exploit this to access or modify sensitive information. C Tenable Network Security, Inc. include"compat.inc"; ifdescription...

CVE-2003-0015

Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands...

DSquare Exploit Pack: D2SEC_PSERVERD

Name| d2secpserverd ---|--- CVE| CAN-2003-0015 Exploit Pack| D2ExploitPack Description| CVS pserverd arbitrary command remote execution Notes|...

CVE-2003-0015

Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands...

FreeBSD-SA-03:01.cvs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-03:01.cvs Security Advisory The FreeBSD Project Topic: remotely exploitable vulnerability in cvs server Category: contrib Module: contribcvs Announced: 2003-02-04...

CERT Advisory CA-2003-02 Double-Free Bug in CVS Server

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2003-02 Double-Free Bug in CVS Server Original issue date: January 22, 2003 Last revised: -- Source: CERT/CC A complete revision history is at the end of this file. Systems Affected Systems running CVS Home project versions of CVS prior to 1.11....

CVS double free bug

Double free bug on processing directory request...

Advisory 01/2003: CVS remote vulnerability

e-matters GmbH www.e-matters.de -= Security Advisory =- Advisory: CVS remote vulnerability Release Date: 2003/01/20 Last Modified: 2003/01/20 Author: Stefan Esser [email protected] Application: CVS = 1.11.4 Severity: A vulnerability within CVS allows remote compromise of CVS servers. Risk:...

New CVS packages available

New cvs packages are available to fix a security vulnerability. Here are the details from the Slackware 8.1 ChangeLog: ---------------------------- Tue Jan 21 13:12:20 PST 2003 patches/packages/cvs-1.11.5-i386-1.tgz: Upgraded to cvs-1.11.5. This release fixes a major security vulnerability in the...

[SECURITY] [DSA 233-1] New cvs packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 233-1 [email protected] http://www.debian.org/security/ Martin Schulze January 21st, 2003 http://www.debian.org/security/faq -...

[SECURITY] [DSA 233-1] New cvs packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 233-1 [email protected] http://www.debian.org/security/ Martin Schulze January 21st, 2003 http://www.debian.org/security/faq -...

DSA-233 cvs - doubly freed memory

Bulletin has no description...

Critical: Red Hat Security Advisory: : : : Updated CVS packages available

Updated cvs packages are now available for Red Hat Linux 6.2, 7, 7.1, 7.2, 7.3, and 8.0. These updates close a vulnerability which would permit arbitrary command execution on servers configured to allow anonymous read-only access. Updated 16 April 2003 Added packages for Red Hat Linux on IBM...

Critical: Red Hat Security Advisory: cvs security update

Updated CVS packages are now available for Red Hat Linux Advanced Server. These updates fix a vulnerability which would permit arbitrary command execution on servers configured to allow anonymous read-only access. Updated 06 Feb 2003 Added fixed packages for Advanced Workstation 2.1 CVS is a...

CVS 1.11.x - Directory Request Double-Free Heap Corruption

CVS 1.11.x - Directory Request Double-Free Heap Corruption source: https://www.securityfocus.com/bid/6650/info CVS is prone to a double free vulnerability in the Directory requests. An attacker may potentially take advantage of this issue to cause heap memory to be corrupted with attacker-supplie...