CVE-2004-0416: Cvs

High severity, CVSS 10.0. EPSS: 13.2% chance of exploitation in the next 30 days.

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Affected products

• Cvs Cvs: version 1.10.7 only; version 1.10.8 only; version 1.11 only; version 1.11.1 only; version 1.11.1_p1 only; version 1.11.2 only; …
• Gentoo Linux: version 1.4 only
• OpenBSD OpenBSD: any version; version 3.4 only; version 3.5 only
• Openpkg Openpkg: any version; version 1.3 only; version 2.0 only
• Sgi Propack: version 2.4 only; version 3.0 only

Published 2004-08-06. Last modified 2026-06-16.