FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0418

This CVE name corresponds to:

Entered	Topic
2004-08-17	cvs -- numerous vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0418 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0418
Phase	Assigned(20040416)

Description

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.

References

Source	Reference
FULLDISC	20040609 Advisory 09/2004: More CVS remote vulnerabilities
MISC	http://security.e-matters.de/advisories/092004.html
DEBIAN	DSA-519
GENTOO	GLSA-200406-06
SUSE	SuSE-SA:2004:015
REDHAT	RHSA-2004:233
MANDRAKE	MDKSA-2004:058
SGI	20040604-01-U
SGI	20040605-01-U
BUGTRAQ	20040611 [OpenPKG-SA-2004.027] OpenPKG Security Advisory (cvs)
OVAL	oval:org.mitre.oval:def:1003
OVAL	oval:org.mitre.oval:def:11242