CVE-2004-1471 EXPLOIT
7.1
HIGH · CVSS 2.0 · EPSS 7.7% (pctl 94)
Patch early
A public exploit exists.
Description
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
Scoring
| CVSS | 7.1 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:H/Au:S/C:C/I:C/A:C |
| EPSS | 7.72% — more likely to be exploited than 94% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2004-12-31 |
| Last modified | 2026-06-16 |
Affected (6)
| Vendor | Product |
|---|---|
| cvs | cvs |
| freebsd | freebsd |
| gentoo | linux |
| openbsd | openbsd |
| openpkg | openpkg |
| sgi | propack |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | CVS 1.11.x - Multiple Vulnerabilities | 2004-06-09 |
References
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
- http://security.e-matters.de/advisories/092004.html
- http://www.securityfocus.com/bid/10499
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16365
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
- http://security.e-matters.de/advisories/092004.html
- http://www.securityfocus.com/bid/10499
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16365
→ the Explorer · watch your stack · NVD