CVE Vulnerabilities

CVE-2004-0418

Published: Aug 06, 2004 | Modified: May 03, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
10 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an out-of-bounds write for a single byte to execute arbitrary code or modify critical program data.

Affected Software

Name Vendor Start Version End Version
Cvs Cvs 1.10.7 1.10.7
Cvs Cvs 1.10.8 1.10.8
Cvs Cvs 1.11 1.11
Cvs Cvs 1.11.1 1.11.1
Cvs Cvs 1.11.1_p1 1.11.1_p1
Cvs Cvs 1.11.2 1.11.2
Cvs Cvs 1.11.3 1.11.3
Cvs Cvs 1.11.4 1.11.4
Cvs Cvs 1.11.5 1.11.5
Cvs Cvs 1.11.6 1.11.6
Cvs Cvs 1.11.10 1.11.10
Cvs Cvs 1.11.11 1.11.11
Cvs Cvs 1.11.14 1.11.14
Cvs Cvs 1.11.15 1.11.15
Cvs Cvs 1.11.16 1.11.16
Cvs Cvs 1.12.1 1.12.1
Cvs Cvs 1.12.2 1.12.2
Cvs Cvs 1.12.5 1.12.5
Cvs Cvs 1.12.7 1.12.7
Cvs Cvs 1.12.8 1.12.8
Openpkg Openpkg * *
Openpkg Openpkg 1.3 1.3
Openpkg Openpkg 2.0 2.0
Propack Sgi 2.4 2.4
Propack Sgi 3.0 3.0
Red Hat Enterprise Linux 3 RedHat cvs-0:1.11.2-24 *
Cvs Ubuntu dapper *
Cvs Ubuntu devel *
Cvs Ubuntu edgy *
Cvs Ubuntu feisty *

References