Back
CVE-2004-1471
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
Published: Dec 31, 2004
Modified: Jun 16, 2026
CVSS Metrics
Affected Products (111)
| Vendor | Product | Version |
|---|---|---|
| cvs | cvs | 1.10.7 |
| cvs | cvs | 1.10.8 |
| cvs | cvs | 1.11 |
| cvs | cvs | 1.11.1 |
| cvs | cvs | 1.11.1_p1 |
| cvs | cvs | 1.11.2 |
| cvs | cvs | 1.11.3 |
| cvs | cvs | 1.11.4 |
| cvs | cvs | 1.11.5 |
| cvs | cvs | 1.11.6 |
| cvs | cvs | 1.11.10 |
| cvs | cvs | 1.11.11 |
| cvs | cvs | 1.11.14 |
| cvs | cvs | 1.11.15 |
| cvs | cvs | 1.11.16 |
| cvs | cvs | 1.12.1 |
| cvs | cvs | 1.12.2 |
| cvs | cvs | 1.12.5 |
| cvs | cvs | 1.12.7 |
| cvs | cvs | 1.12.8 |
…and 91 more
GitHub Security Advisory GHSA-mpm3-c55x-2wp9
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16...
References (10)
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc Vendor Advisory
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html Vendor Advisory
- http://security.e-matters.de/advisories/092004.html
- http://www.securityfocus.com/bid/10499 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16365
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-04:14.cvs.asc Vendor Advisory
- http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html Vendor Advisory
- http://security.e-matters.de/advisories/092004.html
- http://www.securityfocus.com/bid/10499 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16365
Risk Scores
CVSS Score
7.1 / 10
EPSS Score
7.72%
Top 6% most likely to be exploited
Threat Score
30.7 / 100
Data Sources
NVD
EPSS
GitHub