cvs vulnerabilities and fixes

Recent CVEs affecting cvs, with upgrade or downgrade steps. 24 tracked.

cvs has 24 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2022-04-12. Highest priority: CVE-2004-0416 (score 69/100).

• CVE-2022-29037 MEDIUM 5.4 UPGRADE Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters o
• CVE-2020-2324 HIGH 7.5 UPGRADE Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) att
• CVE-2017-12836 HIGH 7.5 DOWNGRADE MITIGATE CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitr
• CVE-2012-0804 HIGH 10.0 DOWNGRADE Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HT
• CVE-2010-3846 MEDIUM 6.9 DOWNGRADE Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileg
• CVE-2005-2693 MEDIUM 4.6 DOWNGRADE cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite ar
• CVE-2005-0753 HIGH 7.5 DOWNGRADE Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code.
• CVE-2004-1471 HIGH 7.1 DOWNGRADE DOWNGRADE Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remot
• CVE-2004-1343 MEDIUM 5.0 DOWNGRADE CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository do
• CVE-2004-1342 HIGH 7.5 DOWNGRADE CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass auth
• CVE-2004-0778 MEDIUM 5.0 UPGRADE CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arb
• CVE-2004-0418 HIGH 10.0 DOWNGRADE DOWNGRADE serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lin
• CVE-2004-0417 MEDIUM 5.0 DOWNGRADE DOWNGRADE Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, an
• CVE-2004-0416 HIGH 10.0 DOWNGRADE DOWNGRADE Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11
• CVE-2004-0414 HIGH 10.0 DOWNGRADE DOWNGRADE CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which
• CVE-2004-0405 MEDIUM 5.0 UPGRADE CVS before 1.11 allows CVS clients to read arbitrary files via .
• CVE-2004-0396 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechan
• CVE-2004-0180 LOW 2.6 UPGRADE The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RC
• CVE-2003-0977 HIGH 7.5 DOWNGRADE MITIGATE CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the f
• CVE-2003-0015 HIGH 7.5 MITIGATE DOWNGRADE Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and p
• CVE-2002-0844 HIGH 7.8 UPGRADE Off-by-one overflow in the CVS PreservePermissions of rcs.c for CVSD before 1.11.2 allows local users to execu
• CVE-2002-0092 MEDIUM 5.0 UPGRADE CVS before 1.10.8 does not properly initialize a global variable, which allows remote attackers to cause a den
• CVE-2000-0680 HIGH 7.2 DOWNGRADE The CVS 1.10.8 server does not properly restrict users from creating arbitrary Checkin.prog or Update.prog pro
• CVE-2000-0679 LOW 2.1 DOWNGRADE The CVS 1.10.8 client trusts pathnames that are provided by the CVS server, which allows the server to force t

FAQ

How do I fix cvs vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is cvs being exploited right now?

None of the tracked cvs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which cvs CVE should I patch first?

CVE-2004-0416 currently ranks highest (69/100): Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.

RSS feed for cvs · ← Back to latest CVEs