CVE-2004-1471

Severity: high (CVSS 7.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2004-12-31 · updated 2026-06-16

Description

Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.

Affected products

Cvs: 1.10.7, 1.10.8, 1.11, 1.11.1, 1.11.1_p1, 1.11.2 (+14)
FreeBSD: 1.1.5.1, 2.0, 2.0.5, 2.1.0, 2.1.5, 2.1.6 (+76)
gentoo Linux: 1.4
OpenBSD: 3.4, 3.5, current
Openpkg: 1.3, 2.0, current
Sgi Propack: 2.4, 3.0

References

http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
http://security.e-matters.de/advisories/092004.html
http://www.securityfocus.com/bid/10499
https://exchange.xforce.ibmcloud.com/vulnerabilities/16365
http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
http://security.e-matters.de/advisories/092004.html
http://www.securityfocus.com/bid/10499
https://exchange.xforce.ibmcloud.com/vulnerabilities/16365

Get alerted when CVE-2004-1471 or the next vulnerability affects your stack