Ubuntu Security Notice 1371-1 - It was discovered that cvs incorrectly handled certain responses from proxy servers. If a user were tricked into connecting to a malicious proxy server, a remote attacker could cause cvs to crash, or possibly execute arbitrary code.
456195625d6524c03923a1457d002d80445f9f034e991f9bbf3bbe3eb73ae6a5
============================================================================
Ubuntu Security Notice USN-1371-1
February 22, 2012
cvs vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
cvs could be made to crash or run programs as your login if it connected to
a malicious proxy server.
Software Description:
- cvs: Concurrent Versions System
Details:
It was discovered that cvs incorrectly handled certain responses from
proxy servers. If a user were tricked into connecting to a malicious proxy
server, a remote attacker could cause cvs to crash, or possibly execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
cvs 2:1.12.13+real-6ubuntu0.1
Ubuntu 11.04:
cvs 1:1.12.13-12ubuntu1.11.04.1
Ubuntu 10.10:
cvs 1:1.12.13-12ubuntu1.10.10.1
Ubuntu 10.04 LTS:
cvs 1:1.12.13-12ubuntu1.10.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1371-1
CVE-2012-0804
Package Information:
https://launchpad.net/ubuntu/+source/cvs/2:1.12.13+real-6ubuntu0.1
https://launchpad.net/ubuntu/+source/cvs/1:1.12.13-12ubuntu1.11.04.1
https://launchpad.net/ubuntu/+source/cvs/1:1.12.13-12ubuntu1.10.10.1
https://launchpad.net/ubuntu/+source/cvs/1:1.12.13-12ubuntu1.10.04.1