Lucene search
SuseSUSE-SA:2004:015HistoryJun 09, 2004 - 1:52 p.m.
remote command execution in cvs
2004-06-0913:52:11
lists.opensuse.org
15
0.933 High
EPSS
Percentile
99.1%
The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. Various remotely exploitable conditions have been found during a source code review of CVS done by Stefan Esser and Sebastian Krahmer (SuSE Security-Team). These bugs allow remote attackers to execute arbitrary code as the user the CVS server runs as. Since there is no easy workaround we strongly recommend to update the cvs package. The update packages fix vulnerabilities which have been assigned the CAN numbers CAN-2004-0416, CAN-2004-0417 and CAN-2004-0418. The cvs packages shipped by SUSE (as well as our recent updates for CVS) are not vulnerable to CAN-2004-0414.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| openSUSE | 9.1 | i586 | cvs | < 1.11.14-24.6 | cvs-1.11.14-24.6.i586.rpm |
| openSUSE | 8.0 | i386 | cvs | < 1.11.1p1-332 | cvs-1.11.1p1-332.i386.rpm |
| openSUSE | 8.2 | i586 | cvs | < 1.11.5-114 | cvs-1.11.5-114.i586.rpm |
| openSUSE | 8.1 | i586 | cvs | < 1.11.1p1-332 | cvs-1.11.1p1-332.i586.rpm |
| openSUSE | 9.0 | i586 | cvs | < 1.11.6-83 | cvs-1.11.6-83.i586.rpm |
| openSUSE | 9.0 | x86_64 | cvs | < 1.11.6-83 | cvs-1.11.6-83.x86_64.rpm |
| openSUSE | 9.1 | x86_64 | cvs | < 1.11.14-24.6 | cvs-1.11.14-24.6.x86_64.rpm |
Related
nessus
nessus
Slackware 8.1 / 9.0 / 9.1 / current : apache (SSA:2004-133-01)
2005-07-13 00:00:00
Debian DSA-517-1 : cvs - buffer overflow
2004-09-29 00:00:00
Fedora Core 2 : cvs-1.11.17-2 (2004-170)
2004-07-23 00:00:00
openvas
openvas
Slackware: Security Advisory (SSA:2004-133-01)
2012-09-10 00:00:00
CVS malformed entry lines flaw
2005-11-03 00:00:00
Slackware Advisory SSA:2004-133-01 apache
2012-09-11 00:00:00
gentoo
gentoo
CVS: additional DoS and arbitrary code execution vulnerabilities
2004-06-10 00:00:00
Apache 1.3: Multiple vulnerabilities
2004-05-26 00:00:00
neon heap-based buffer overflow
2004-05-20 00:00:00
securityvulns
securityvulns
[Full-Disclosure] Advisory 09/2004: More CVS remote vulnerabilities
2004-06-09 00:00:00
SUSE Security Announcement: kernel (SuSE-SA:2004:017)
2004-06-18 00:00:00
SUSE Security Announcement: cvs (SuSE-SA:2004:008)
2004-04-15 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 5 package cvs version 1.11.15-alt4
2004-06-08 00:00:00
Security fix for the ALT Linux 10 package apache2 version 2.0.40-21
2003-02-24 00:00:00
Security fix for the ALT Linux 8 package apache2 version 2.0.40-21
2003-02-24 00:00:00
suse
suse
remote file creation in kdelibs/kdelibs3
2004-05-26 11:35:37
remote system compromise in subversion
2004-06-17 09:42:39
local denial-of-service attack in kernel
2004-06-16 14:13:55
freebsd
freebsd
cvs -- numerous vulnerabilities
2004-05-20 00:00:00
neon date parsing vulnerability
2004-05-19 00:00:00
Apache 1.3 IP address access control failure on some 64-bit platforms
2004-03-07 00:00:00
debian
debian
[SECURITY] [DSA 517-1] New CVS packages fix buffer overflow
2004-06-10 10:00:39
osv
osv
cvs - several vulnerabilities
2004-06-15 00:00:00
neon - buffer overflow
2004-05-19 00:00:00
cvs - buffer overflow
2004-06-10 00:00:00
redhat
redhat
(RHSA-2004:233) cvs security update
2004-06-09 00:00:00
(RHSA-2004:191) cadaver security update
2004-05-19 00:00:00
(RHSA-2004:157) cadaver security update
2004-04-14 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-04:14.cvs
2004-09-19 00:00:00
ubuntucve
ubuntucve
debiancve
debiancve
f5
f5
K5576 : Authentication vulnerability in Apache mod_digest - CAN-2003-0987
2013-03-28 00:00:00
SOL5576 - Authentication vulnerability in Apache mod_digest - CAN-2003-0987
2007-05-16 00:00:00
nvd
nvd
cve
cve
cvelist
cvelist
httpd
httpd
Apache Httpd < 1.3.31 : mod_digest nonce checking
2003-12-18 00:00:00
Apache Httpd < 1.3.31 : Allow/Deny parsing on big-endian 64-bit platforms
2003-10-15 00:00:00
Apache Httpd < 1.3.31 : Error log escape filtering
2003-02-24 00:00:00
checkpoint_advisories
checkpoint_advisories
CVS Max-dotdot Protocol Command Integer Overflow - Ver2 (CVE-2004-0417)
2014-12-28 00:00:00
CVS Argumentx Command Double Free (CVE-2004-0416)
2009-10-15 00:00:00
CVS Max-dotdot Protocol Command Integer Overflow (CVE-2004-0417)
2009-11-15 00:00:00
cert
cert