CVE-2004-0416

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x...

10.0 HighPublic exploitFix available

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Exploit likelihood

13.2%Down 27.4 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: CVE-2004-0416
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: CVE-2004-0416
Updated: 2026-11-02

EUVDEUVD-2004-0415 No score

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: EUVD-2004-0415
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xrvc-m3hh-hp9h No score

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x...

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: GHSA-xrvc-m3hh-hp9h
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: CVE-2004-0416
Updated: 2026-11-02

OSVDEBIAN-CVE-2004-0416 No score

Double free vulnerability for the error_prog_name string in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to execute arbitrary code.

Record: DEBIAN-CVE-2004-0416
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cvs` Debian:12	before 1:1.12.9-1	1:1.12.9-1
`cvs` Debian:13	before 1:1.12.9-1	1:1.12.9-1
`cvs` Debian:14	before 1:1.12.9-1	1:1.12.9-1
`cvs` Debian:3.0 From an advisory covering 3 CVEs	before 1.11.1p1debian-9woody7	1.11.1p1debian-9woody7
`cvs` Red Hat:enterprise_linux:3::as From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs-debuginfo` Red Hat:enterprise_linux:3::as From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs` Red Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs-debuginfo` Red Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs` Red Hat:enterprise_linux:3::es From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs-debuginfo` Red Hat:enterprise_linux:3::es From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs` Red Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24
`cvs-debuginfo` Red Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs	before 0:1.11.2-24	0:1.11.2-24

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Remote CVS 1.11.15 - 'error_prog_name' Arbitrary Code Execution	2004-08-13

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-0416 is a high vulnerability (CVSS 10.0) in Cvs, published June 11, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.2%, the 96th percentile. Fixed in cvs 1:1.12.9-1.

References

Show 28 moreShow less