Unscored severity · published Jun 14, 2004
CVE-2004-0396
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines
–
CVSS
67.5%
EPSS
No
On KEV
Description
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
Exploitation
Is it being used?
Exploit prediction (EPSS)67.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CV
Cvs · Cvs
1.11; 1.12 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-0396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-0396
archives.neohapsis.com
http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0980.html
cert.uni-stuttgart.de
http://cert.uni-stuttgart.de/archive/bugtraq/2004/05/msg00219.html
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021742.html
marc.info
http://marc.info/?l=bugtraq&m=108498454829020&w=2
More from Cvs
–
CVE-2012-0804
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly…
–
CVE-2005-2693
cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack
–
CVE-2004-1342
CVS 1.12 and earlier on Debian GNU/Linux, when using the repouid patch, allows remote attackers to bypass authentication via the pserver access method
–
CVE-2005-0753
Buffer overflow in CVS before 1.11.20 allows remote attackers to execute arbitrary code
–
CVE-2004-1343
CVS 1.12 and earlier on Debian GNU/Linux does not properly handle when a mapping for the current repository does not exist in the cvs-repouids file, which allows remote attackers…