CVE-2003-0977

HIGH 7.5CVE-2003-0977 · Published 05/01/2004 · updated 16/06/2026

In short

CVE-2003-0977 is a HIGH (CVSS 7.5) vulnerability affecting cvs (cvs).
Chance of exploitation in the next 30 days (EPSS): 2.5%, higher than 84.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cvs cvs	`= 1.10.7= 1.10.8= 1.11= 1.11.1= 1.11.1_p1= 1.11.2= 1.11.3= 1.11.4= 1.11.5= 1.11.6`	No fix yet

Description

CVS server before 1.11.10 may allow attackers to cause the CVS server to create directories and files in the file system root directory via malformed module requests.

References

patches.sgi.com/support/free/security/advisories/20040103-01-U.asc
patches.sgi.com/support/free/security/advisories/20040202-01-U.asc
ccvs.cvshome.org/servlets/NewsItemView · Patch
distro.conectiva.com.br/atualizacoes
marc.info
marc.info
secunia.com/advisories/10601
debian.org/security/2004/dsa-422 · Patch
mandriva.com/security/advisories
redhat.com/support/errata/RHSA-2004-003.html
redhat.com/support/errata/RHSA-2004-004.html
exchange.xforce.ibmcloud.com/vulnerabilities/13929
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11528

More vulnerabilities in cvs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free