Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cvs | Aug 22, 2024 | May 29, 2012 |
| Centos_linux | — | Upgrade cvs | Dec 1, 2016 | May 29, 2012 |
| Debian | — | Upgrade cvs | Jul 30, 2024 | May 29, 2012 |
| Gentoo Linux | — | Upgrade dev-vcs/cvs. | Oct 30, 2017 | May 29, 2012 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.2.0.0.42.0 on Solaris 11.2 | May 29, 2017 | May 29, 2012 |
| Oracle_linux | — | Upgrade cvs-inetdUpgrade cvs | Oct 16, 2024 | May 29, 2012 |
| Suse | — | Upgrade cvs-docUpgrade cvs | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cvs | Nov 8, 2024 | May 29, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub