Description
Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cvs | 1:1.12.9-1 | — |
| Debian 13 | cvs | 1:1.12.9-1 | — |
| Debian 12 | cvs | 1:1.12.9-1 | — |
| Debian 3.0 | cvs | 1.11.1p1debian-9woody7 | DSA-519 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | cvs | 1.11.2-24 | RHSA-2004:233 |
Advisories 2
- RHSA-2004:233 Red Hat Security Advisory: cvs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-519 cvs - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:11145 vdb-entry signature
- DSA-519 vendor-advisory
- http://security.e-matters.de/advisories/092004.html
- 20040611 [OpenPKG-SA-2004.027] OpenPKG Security Advisory (cvs) mailing-list
- RHSA-2004:233 vendor-advisory
- MDKSA-2004:058 vendor-advisory
- GLSA-200406-06 vendor-advisory
- oval:org.mitre.oval:def:1001 vdb-entry signature
- 20040609 Advisory 09/2004: More CVS remote vulnerabilities mailing-list