Gentoo: cvs Unauthorized access vulnerability
This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root.
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- -------------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200312-04 - --------------------------------------------------------------------------
GLSA: 200312-04 package: dev-util/cvs summary: Fix for malformed module request vulnerability in cvs severity: minimal Gentoo bug: 35371 date: 2003-12-08 CVE: CAN-2003-0977 exploit: unknown affected: <=1.11.9 fixed:>=1.11.10
DESCRIPTION:
Quote from <;:
Stable CVS 1.11.10 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs. We recommend this upgrade for all CVS clients and servers!"
SOLUTION:
All Gentoo Linux machines with cvs installed should be updated to use cvs-1.11.10 or higher.
emerge sync emerge -pv '>=dev-util/cvs-1.11.10' emerge '>=dev-util/cvs-1.11.10' emerge clean
// end
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (Darwin)
iD8DBQE/2BrHnt0v0zAqOHYRAt7HAJ9wVNUmbdvS5H4cyUMufSFLsAuhOACfRGWr SuM+gRSKU69MybE6PRtYSrg=SQFw
=1.11.9
Resolution
References
Availability
Concerns
Severity
