| Package | Affected versions | Patched versions |
|---|---|---|
| cvs | = 1.10.7= 1.10.8= 1.11= 1.11.1= 1.11.10= 1.11.11= 1.11.14= 1.11.15= 1.11.16= 1.11.1_p1= 1.11.2= 1.11.3= 1.11.4= 1.11.5= 1.11.6= 1.12.1= 1.12.2= 1.12.5= 1.12.7= 1.12.8 | |
| openpkg | = 1.3= 2.0 | |
| propack | = 2.4= 3.0 |
serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free