Login Request a demo
Unscored severity · published Jan 5, 2004
CVE-2003-0977
CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests
–
CVSS
2.5%
EPSS
No
On KEV
Description
CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
Cvs · Cvs
1.10.7; 1.10.8; 1.11; 1.11.1; 1.11.1_p1; 1.11.2; +4 more · source: NVD
SL
Slackware Linux · Slackware
8.1; 9.0; 9.1 · source: NVD
Affected product
CV
Cvs
Cvs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0977
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0977
Patch
http://ccvs.cvshome.org/servlets/NewsItemView?newsID=84&JServSessionIdservlets=8u3x1myav1
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000808
marc.info
http://marc.info/?l=bugtraq&m=107168035515554&w=2
marc.info
http://marc.info/?l=bugtraq&m=107540163908129&w=2
More from Cvs
–
CVE-2012-0804
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly…
–
CVE-2005-2693
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack
–
CVE-2004-1342
CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method
–
CVE-2005-0753
Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code
–
CVE-2004-1343
CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers…