FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-04-04 17:02:35 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
d2102505-f03d-11d8-81b0-000347a4fa7dcvs -- numerous vulnerabilities

A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price.

  • Insufficient input validation while processing "Entry" lines. (CVE-2004-0414)
  • A double-free resulting from erroneous state handling while processing "Argumentx" commands. (CVE-2004-0416)
  • Integer overflow while processing "Max-dotdot" commands. (CVE-2004-0417)
  • Erroneous handling of empty entries handled while processing "Notify" commands. (CVE-2004-0418)
  • A format string bug while processing CVS wrappers.
  • Single-byte buffer underflows while processing configuration files from CVSROOT.
  • Various other integer overflows.

Additionally, iDEFENSE reports an undocumented command-line flag used in debugging does not perform input validation on the given path names.

CVS servers ("cvs server" or :pserver: modes) are affected by these vulnerabilities. They vary in impact but include information disclosure (the iDEFENSE-reported bug), denial-of-service (CVE-2004-0414, CVE-2004-0416, CVE-2004-0417 and other bugs), or possibly arbitrary code execution (CVE-2004-0418). In very special situations where the attacker may somehow influence the contents of CVS configuration files in CVSROOT, additional attacks may be possible.


Discovery 2004-05-20
Entry 2004-08-17
Modified 2004-09-19
cvs+ipv6
< 1.11.17

FreeBSD
>= 5.2 lt 5.2.1_10

>= 4.10 lt 4.10_3

>= 4.9 lt 4.9_12

>= 4.8 lt 4.8_25

SA-04:14.cvs
CVE-2004-0414
CVE-2004-0416
CVE-2004-0417
CVE-2004-0418
CVE-2004-0778
http://secunia.com/advisories/11817
http://secunia.com/advisories/12309
http://security.e-matters.de/advisories/092004.html
http://www.idefense.com/application/poi/display?id=130&type=vulnerabilities&flashstatus=false
https://ccvs.cvshome.org/source/browse/ccvs/NEWS?rev=1.116.2.104
http://www.osvdb.org/6830
http://www.osvdb.org/6831
http://www.osvdb.org/6832
http://www.osvdb.org/6833
http://www.osvdb.org/6834
http://www.osvdb.org/6835
http://www.osvdb.org/6836
10499
c5c17ead-8f23-11da-8c1d-000e0c2e438acvsbug -- race condition

Problem description

A temporary file is created, used, deleted, and then re-created with the same name. This creates a window during which an attacker could replace the file with a link to another file. While cvsbug(1) is based on the send-pr(1) utility, this problem does not exist in the version of send-pr(1) distributed with FreeBSD.

In FreeBSD 4.10 and 5.3, some additional problems exist concerning temporary file usage in both cvsbug(1) and send-pr(1).

Impact

A local attacker could cause data to be written to any file to which the user running cvsbug(1) (or send-pr(1) in FreeBSD 4.10 and 5.3) has write access. This may cause damage in itself (e.g., by destroying important system files or documents) or may be used to obtain elevated privileges.

Workaround

Do not use the cvsbug(1) utility on any system with untrusted users.

Do not use the send-pr(1) utility on a FreeBSD 4.10 or 5.3 system with untrusted users.


Discovery 2005-09-07
Entry 2006-01-27
Modified 2006-11-08
FreeBSD
>= 5.4 lt 5.4_7

>= 5.3 lt 5.3_22

>= 4.11 lt 4.11_12

>= 4.10 lt 4.10_18

cvs+ipv6
< 1.11.17_1

CAN-2005-2693
SA-05:20.cvsbug