PT-2004-1553 · Cvs · Cvs

Published 2004-06-11 · Updated 2018-05-03 · CVE-2004-0414

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CVS versions 1.11.x through 1.11.16 CVS versions 1.12.x through 1.12.8

Description The issue arises from the improper handling of malformed "Entry" lines, which can prevent a NULL terminator from being used. This may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

Recommendations For CVS versions 1.11.x through 1.11.16, update to a version that properly handles malformed "Entry" lines to prevent potential crashes or code execution. For CVS versions 1.12.x through 1.12.8, update to a version that properly handles malformed "Entry" lines to prevent potential crashes or code execution.

Fix

Related Identifiers

CVE-2004-0414

DSA-517

RHSA-2004:233

Affected Products

Cvs

References · 15

• ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-233.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200406-06.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0414 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0414 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0414 · Vendor Advisory
• http://debian.org/security/2004/dsa-517 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:058 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0414 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc · Vendor Advisory
• http://security.e-matters.de/advisories/092004.html · Note
• http://marc.info/?l=bugtraq&m=108716553923643&w=2 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10575 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A993 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html · Note