Opened 12 years ago

Closed 12 years ago

Last modified 10 years ago

#3396 closed task (invalid)

CVS needs to be patched

Reported by: Thomas de Roo Owned by: blfs-book@…
Priority: normal Milestone:
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

See ​http://lists.debian.org/debian-security-announce/2012/msg00034.html

Change History (2)

comment:1 by bdubbs@…, 12 years ago

Resolution: → invalid
Status: new → closed

I'm marking this as invalid. The announcement revers to CVE-2012-0804. That advisory says "Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12"

There is no function proxy_connect() in cvs-1.11.23. The Debian entry indicates several changes to the base system (a 10K patch) and RedHat indicates several changes to the base system:

​https://bugzilla.redhat.com/show_bug.cgi?id=784141

Note that at ​http://ftp.gnu.org/non-gnu/cvs/source the most recent versions are: 

http://ftp.gnu.org/non-gnu/cvs/source/feature/1.12.13/  03-Oct-2005
http://ftp.gnu.org/non-gnu/cvs/source/stable/1.11.23/   08-May-2008

We use the stable version. The vulnerability is in the patches made by others after the stable release.

comment:2 by bdubbs@…, 10 years ago

Milestone: current

Milestone current deleted

Note: See TracTickets for help on using tickets.