CVE-2004-1471
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16...
CVE-2004-1471 is a high vulnerability (CVSS 7.1) in Cvs, published December 31, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.72%, the 94th percentile. Fixed in cvs 1:1.12.9.
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
CVE-2004-1471- CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
CVE-2004-1471- Updated
- 2026-11-02
EUVDEUVD-2004-1465 No score
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
EUVD-2004-1465- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mpm3-c55x-2wp9 No score
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16...
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
GHSA-mpm3-c55x-2wp9- Updated
- 2026-11-02
OSV No score
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
CVE-2004-1471- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-1471 No score
Format string vulnerability in wrapper.c in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16 allows remote attackers with CVSROOT commit access to cause a denial of service (application crash) and possibly execute arbitrary code via format string specifiers in a wrapper line.
- Record
DEBIAN-CVE-2004-1471- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | CVS 1.11.x - Multiple Vulnerabilities | 2004-06-09 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
security.e-matters.de/advisories/092004.html
securityfocus.com/bid/10499
exchange.xforce.ibmcloud.com/vulnerabilities/16365
lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
nvd.nist.gov/vuln/detail/CVE-2004-1471
github.com/advisories/GHSA-mpm3-c55x-2wp9
security-tracker.debian.org/tracker/CVE-2004-1471