TI-2004-00382 Aliases CVE-2004-0418 GHSA-fv5v-25hp-gmw7

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly…

MEDIUM 51Published 2004-06-11 · Updated 2024-08-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.

Why it matters now

EPSS 0.05681 93rd percentileScored 2026-11-07

Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPE	Versions	Role	Vendor
cpe:2.3:a:cvs:cvs:1.10.7:::::::*	1.10.7	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.10.8:::::::*	1.10.8	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11:::::::*	1.11	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.1:::::::*	1.11.1	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.1_p1:::::::*	1.11.1_p1	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.2:::::::*	1.11.2	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.3:::::::*	1.11.3	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.4:::::::*	1.11.4	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.5:::::::*	1.11.5	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.6:::::::*	1.11.6	Vulnerable	Cvs

cpe:2.3:a:cvs:cvs:1.10.7:*:*:*:*:*:*:* Versions 1.10.7 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.10.8:*:*:*:*:*:*:* Versions 1.10.8 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.1_p1:*:*:*:*:*:*:* Versions 1.11.1_p1 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.4:*:*:*:*:*:*:* Versions 1.11.4 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.5:*:*:*:*:*:*:* Versions 1.11.5 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.6:*:*:*:*:*:*:* Versions 1.11.6 Vulnerable ·Cvs

Show 19 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:cvs:cvs:1.11.10:::::::*	1.11.10	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.11:::::::*	1.11.11	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.14:::::::*	1.11.14	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.15:::::::*	1.11.15	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.11.16:::::::*	1.11.16	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.12.1:::::::*	1.12.1	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.12.2:::::::*	1.12.2	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.12.5:::::::*	1.12.5	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.12.7:::::::*	1.12.7	Vulnerable	Cvs
cpe:2.3:a:cvs:cvs:1.12.8:::::::*	1.12.8	Vulnerable	Cvs
cpe:2.3:a:openpkg:openpkg::::::::	all versions	Vulnerable	Openpkg
cpe:2.3:a:openpkg:openpkg:1.3:::::::*	1.3	Vulnerable	Openpkg
cpe:2.3:a:openpkg:openpkg:2.0:::::::*	2.0	Vulnerable	Openpkg
cpe:2.3:a:sgi:propack:2.4:::::::*	2.4	Vulnerable	Sgi
cpe:2.3:a:sgi:propack:3.0:::::::*	3.0	Vulnerable	Sgi
cpe:2.3:o:gentoo:linux:1.4:::::::*	1.4	Vulnerable	gentoo
cpe:2.3:o:openbsd:openbsd::::::::	all versions	Vulnerable	OpenBSD
cpe:2.3:o:openbsd:openbsd:3.4:::::::*	3.4	Vulnerable	OpenBSD
cpe:2.3:o:openbsd:openbsd:3.5:::::::*	3.5	Vulnerable	OpenBSD

cpe:2.3:a:cvs:cvs:1.11.10:*:*:*:*:*:*:* Versions 1.11.10 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.11:*:*:*:*:*:*:* Versions 1.11.11 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.14:*:*:*:*:*:*:* Versions 1.11.14 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.15:*:*:*:*:*:*:* Versions 1.11.15 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.11.16:*:*:*:*:*:*:* Versions 1.11.16 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.12.1:*:*:*:*:*:*:* Versions 1.12.1 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.12.2:*:*:*:*:*:*:* Versions 1.12.2 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.12.5:*:*:*:*:*:*:* Versions 1.12.5 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.12.7:*:*:*:*:*:*:* Versions 1.12.7 Vulnerable ·Cvs
cpe:2.3:a:cvs:cvs:1.12.8:*:*:*:*:*:*:* Versions 1.12.8 Vulnerable ·Cvs
cpe:2.3:a:openpkg:openpkg:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Openpkg
cpe:2.3:a:openpkg:openpkg:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Openpkg
cpe:2.3:a:openpkg:openpkg:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Openpkg
cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Sgi
cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Sgi
cpe:2.3:o:gentoo:linux:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·gentoo
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·OpenBSD
cpe:2.3:o:openbsd:openbsd:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·OpenBSD
cpe:2.3:o:openbsd:openbsd:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·OpenBSD

Remediation

Red Hat 1 advisory

RHSA-2004:233 Released 2004-06-09 · Red Hat rating Critical
cvs security update
- Red Hat Desktop version 3 cvs-1.11.2-24, cvs-1.11.2-24.i386
- Red Hat Enterprise Linux AS version 3 cvs-1.11.2-24, cvs-1.11.2-24.i386, cvs-1.11.2-24.ia64 +1
- Red Hat Enterprise Linux ES version 3 cvs-1.11.2-24, cvs-1.11.2-24.i386, cvs-1.11.2-24.ia64
- Red Hat Enterprise Linux WS version 3 cvs-1.11.2-24, cvs-1.11.2-24.i386, cvs-1.11.2-24.ia64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Desktop version 3	Fixed	RHSA-2004:233
Red Hat Enterprise Linux AS version 3	Fixed	RHSA-2004:233
Red Hat Enterprise Linux ES version 3	Fixed	RHSA-2004:233
Red Hat Enterprise Linux WS version 3	Fixed	RHSA-2004:233

Timeline

2026-10-02 Threatist record created from CVE-2004-0418
2026-10-03 Alias added: GHSA-fv5v-25hp-gmw7

References

Patch 1

DSA-519

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences