CVE-2004-0180

LOW 2.6CVE-2004-0180 · Published 01/06/2004 · updated 16/06/2026

In short

CVE-2004-0180 is a LOW (CVSS 2.6) vulnerability affecting cvs (cvs).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
cvs cvs	`≤ 1.10`	No fix yet

Description

The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.

References

ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:07.cvs.asc · Patch
ftp.openbsd.org/pub/OpenBSD/patches/3.5/common/002_cvs.patch
patches.sgi.com/support/free/security/advisories/20040404-01-U.asc
marc.info
secunia.com/advisories/11368
secunia.com/advisories/11371
secunia.com/advisories/11374
secunia.com/advisories/11375
secunia.com/advisories/11377
secunia.com/advisories/11380
secunia.com/advisories/11391
secunia.com/advisories/11400
secunia.com/advisories/11405
secunia.com/advisories/11548
security.gentoo.org/glsa/glsa-200404-13.xml
debian.org/security/2004/dsa-486

More vulnerabilities in cvs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free