CVE-2004-0396

CVS <1.11.16-1.12.8 - Buffer Overflow

Title source: llm

Description

Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.

Exploits (2)

exploitdb WORKING POC VERIFIED

by anonymous · cremotesolaris

https://www.exploit-db.com/exploits/301

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Ac1dB1tCh3z · cremotemultiple

https://www.exploit-db.com/exploits/300

View Code ZIP pw:eip

References (28)

[Various Sources] ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:10.cvs.asc

[Third Party Advisory] http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html

[Various Sources] http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html

[Mailing List] http://marc.info/?l=bugtraq&m=108498454829020&w=2

[Mailing List] http://marc.info/?l=bugtraq&m=108500040719512&w=2

[Mailing List] http://marc.info/?l=bugtraq&m=108636445031613&w=2

[Mailing List] http://marc.info/?l=openbsd-security-announce&m=108508894405639&w=2

[Various Sources] http://security.e-matters.de/advisories/072004.html

[Third Party Advisory, US Government Resource] http://www.ciac.org/ciac/bulletins/o-147.shtml

[Patch, Vendor Advisory] http://www.debian.org/security/2004/dsa-505

[Patch, Third Party Advisory, US Government Resource] http://www.kb.cert.org/vuls/id/192038

[Vendor Advisory] http://www.mandriva.com/security/advisories?name=MDKSA-2004:048

[Third Party Advisory, VDB Entry] http://www.osvdb.org/6305

[Patch, Vendor Advisory] http://www.redhat.com/support/errata/RHSA-2004-190.html

[Vendor Advisory] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.395865

[US Government Resource] http://www.us-cert.gov/cas/techalerts/TA04-147A.html

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/16193

[Mailing List] http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html

[Vendor Advisory] ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-008.txt.asc

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/10384

... and 8 more

Scores

EPSS 0.8659

EPSS Percentile 99.4%

Details

Status published

Products (2)

cvs/cvs 1.11

cvs/cvs 1.12

Published Jun 14, 2004

Tracked Since Feb 18, 2026