CVE-2004-0778 CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which cause...
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CVS 1.11.x before 1.11.17, and 1.12.x before 1.12.9, allows remote attackers to determine the existence of arbitrary files and directories via the -X command for an alternate history file, which causes different error messages to be returned.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU cvs | >= 1.11.0, < 1.11.17 | 1.11.17 |
| GNU cvs | >= 1.12.0, < 1.12.9 | 1.12.9 |
| debian/cvs(Debian:12) | < 1:1.12.9 | 1:1.12.9 |
| debian/cvs(Debian:13) | < 1:1.12.9 | 1:1.12.9 |
| debian/cvs(Debian:14) | < 1:1.12.9 | 1:1.12.9 |
References
- 20040816 CVS Undocumented Flag Information Disclosure Vulnerability broken-link third-party-advisory vendor-advisory
- VU#579225 patch third-party-advisory us-government-resource
- MDKSA-2004:108 broken-link vendor-advisory
- 10955 broken-link patch third-party-advisory vdb-entry vendor-advisory
- cvs-history-info-disclosure(17001) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:10688 broken-link signature vdb-entry
- Debian Security Tracker CVE-2004-0778 vendor-advisory