This page displays vulnerability information about FreeBSD Ports.
The last vuln.xml file processed by FreshPorts is:
nothing found there
List all Vulnerabilities, by package
List all Vulnerabilities, by date
These are the vulnerabilities relating to the commit you have selected:
|d2102505-f03d-11d8-81b0-000347a4fa7d||cvs -- numerous vulnerabilities|
A number of vulnerabilities were discovered in CVS by Stefan Esser, Sebastian Krahmer, and Derek Price.
Additionally, iDEFENSE reports an undocumented command-line flag used in debugging does not perform input validation on the given path names.
CVS servers ("cvs server" or :pserver: modes) are affected by these vulnerabilities. They vary in impact but include information disclosure (the iDEFENSE-reported bug), denial-of-service (CVE-2004-0414, CVE-2004-0416, CVE-2004-0417 and other bugs), or possibly arbitrary code execution (CVE-2004-0418). In very special situations where the attacker may somehow influence the contents of CVS configuration files in CVSROOT, additional attacks may be possible.
ge 5.2 lt 5.2.1_10
ge 4.10 lt 4.10_3
ge 4.9 lt 4.9_12
ge 4.8 lt 4.8_25
|c5c17ead-8f23-11da-8c1d-000e0c2e438a||cvsbug -- race condition|
A temporary file is created, used, deleted, and then
re-created with the same name. This creates a window during
which an attacker could replace the file with a link to
another file. While cvsbug(1) is based on the send-pr(1)
utility, this problem does not exist in the version of
send-pr(1) distributed with FreeBSD.
A local attacker could cause data to be written to any file to which the user running cvsbug(1) (or send-pr(1) in FreeBSD 4.10 and 5.3) has write access. This may cause damage in itself (e.g., by destroying important system files or documents) or may be used to obtain elevated privileges.
Do not use the cvsbug(1) utility on any system with untrusted
ge 5.4 lt 5.4_7
ge 5.3 lt 5.3_22
ge 4.11 lt 4.11_12
ge 4.10 lt 4.10_18