Description
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | cvs | 1.11.23-11.el6_0.1 | RHSA-2010:0918 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | cvs | 1.12.12-r0 | — |
| Alpine v3.23 | cvs | 1.12.12-r0 | — |
| Alpine v3.22 | cvs | 1.12.12-r0 | — |
| Alpine v3.21 | cvs | 1.12.12-r0 | — |
| Alpine v3.20 | cvs | 1.12.12-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | cvs | 1.12.12-r0 | — |
| Alpine v3.18 | cvs | 1.12.12-r0 | — |
| Alpine v3.17 | cvs | 1.12.12-r0 | — |
| Alpine v3.16 | cvs | 1.12.12-r0 | — |
| Alpine v3.15 | cvs | 1.12.12-r0 | — |
| Alpine v3.14 | cvs | 1.12.12-r0 | — |
| Alpine v3.13 | cvs | 1.12.12-r0 | — |
| Alpine v3.12 | cvs | 1.12.12-r0 | — |
| Alpine v3.11 | cvs | 1.12.12-r0 | — |
| Alpine v3.10 | cvs | 1.12.12-r0 | — |
| Alpine v3.9 | cvs | 1.12.12-r0 | — |
| Alpine v3.8 | cvs | 1.12.12-r0 | — |
Advisories 1
- RHSA-2010:0918 Red Hat Security Advisory: cvs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 42041 third-party-advisory
- FEDORA-2010-16600 vendor-advisory
- FEDORA-2010-16599 vendor-advisory
- ADV-2010-2846 vdb-entry
- 44528 vdb-entry
- 42409 third-party-advisory
- 68952 vdb-entry
- cvs-applyrcschange-bo(62858) vdb-entry
- FEDORA-2010-16721 vendor-advisory
- ADV-2010-2845 vdb-entry
- 1024795 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=642146
- ADV-2010-3080 vdb-entry
- ADV-2010-2869 vdb-entry
- http://cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev
- 41079 third-party-advisory
- ADV-2010-2899 vdb-entry
- RHSA-2010:0918 vendor-advisory