Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Double-free vulnerability in CVS 1.11.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed Directory request, as demonstrated by bypassing write checks to execute Update-prog and Checkin-prog commands.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CVS远程非法目录请求导致堆破坏漏洞
Vulnerability Description
Concurrent Versions System (CVS)是一款开放源代码的版本控制软件。 CVS的服务代码在处理目录请求时存在缺陷，远程攻击者可以利用这个漏洞进行基于堆破坏的攻击，可能以CVS进程权限在系统上执行任意指令。 当攻击者发送畸形目录名给CVS的时会触发错误条件，使得函数释放了某个缓冲区后并没有分配新的缓冲区。这在下一个目录请求时会发生典型的double-free()问题。 通过其他CVS请求的帮助，可以泄露部分信息用于判断堆的位置或以其他已知漏洞在系统上执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A