CVE-2004-0414: Cvs

High severity, CVSS 10.0. EPSS: 4% chance of exploitation in the next 30 days.

CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being used and may lead to a denial of service (crash), modification of critical program data, or arbitrary code execution.

Affected products

• Cvs Cvs: version 1.10.7 only; version 1.10.8 only; version 1.11 only; version 1.11.1 only; version 1.11.1_p1 only; version 1.11.2 only; …
• Gentoo Linux: version 1.4 only
• OpenBSD OpenBSD: any version; version 3.4 only; version 3.5 only
• Openpkg Openpkg: any version; version 1.3 only; version 2.0 only
• Sgi Propack: version 2.4 only; version 3.0 only

Published 2004-08-06. Last modified 2026-06-16.