CVE-2012-0804: Cvs

High severity, CVSS 10.0. EPSS: 8.4% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.

Affected products

• Cvs Cvs: version 1.11 only; version 1.12 only

Published 2012-05-29. Last modified 2026-06-16.