CVE-2004-1471: Cvs

High severity, CVSS 7.1. EPSS: 7.7% chance of exploitation in the next 30 days.

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.

Affected products

• Cvs Cvs: version 1.10.7 only; version 1.10.8 only; version 1.11 only; version 1.11.1 only; version 1.11.1_p1 only; version 1.11.2 only; …
• Freebsd Freebsd: version 1.1.5.1 only; version 2.0 only; version 2.0.5 only; version 2.1.0 only; version 2.1.5 only; version 2.1.6 only; …
• Gentoo Linux: version 1.4 only
• OpenBSD OpenBSD: version 3.4 only; version 3.5 only; version current only
• Openpkg Openpkg: version 1.3 only; version 2.0 only; version current only
• Sgi Propack: version 2.4 only; version 3.0 only

Published 2004-12-31. Last modified 2026-06-16.