CVE-2004-0180

published 2004-06-01

CVE-2004-0180: The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during…

Priority P4 20 low 2.6 CVSS 2.0

AV N AC H Au N C N I P A N

The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
cvs	cvs	<= 1.10	—
cvs	cvs	>= 0 < 1:1.12.5-4	1:1.12.5-4
cvs	cvs	>= 0 < 1:1.12.5-4	1:1.12.5-4
cvs	cvs	>= 0 < 1:1.12.5-4	1:1.12.5-4
cvs	cvs	>= 0 < 1:1.12.5-4	1:1.12.5-4
debian	cvs	< cvs 1:1.12.5-4 (bookworm)	cvs 1:1.12.5-4 (bookworm)

CVSS provenance

nvd v2.0 2.6 LOW AV:N/AC:H/Au:N/C:N/I:P/A:N

osv 2.6 LOW

vendor_debian 2.6 MEDIUM

vendor_redhat 2.6 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.