CVE-2012-0804
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12...
CVE-2012-0804 is a high vulnerability (CVSS 10.0) in Cvs, published February 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.37%, the 95th percentile. Fixed in cvs 1.12.12-r0.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 8.37%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.12.12-r0cvs +35 more
Description
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.10 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.11 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.12 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.13 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.14 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.15 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.16 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.17 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.18 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.19 | before 1.12.12-r0 | 1.12.12-r0 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.20 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.21 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.22 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.23 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.24 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.8 | before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.9 | before 1.12.12-r0 | 1.12.12-r0 |
cvsDebian:12 | before 2:1.12.13+real-7 | 2:1.12.13+real-7 |
cvsDebian:13 | before 2:1.12.13+real-7 | 2:1.12.13+real-7 |
cvsDebian:14 | before 2:1.12.13+real-7 | 2:1.12.13+real-7 |
cvsDebian:6.0 | before 1:1.12.13-12+squeeze1, plus listed versions 1:1.12.13-12 | 1:1.12.13-12+squeeze1 |
cvsRed Hat:enterprise_linux:5::client | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvs-debuginfoRed Hat:enterprise_linux:5::client | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvs-inetdRed Hat:enterprise_linux:5::client | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvsRed Hat:enterprise_linux:5::server | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvs-debuginfoRed Hat:enterprise_linux:5::server | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvs-inetdRed Hat:enterprise_linux:5::server | before 0:1.11.22-11.el5_8.1 | 0:1.11.22-11.el5_8.1 |
cvsRed Hat:enterprise_linux:6::client | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::client | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvsRed Hat:enterprise_linux:6::computenode | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::computenode | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvsRed Hat:enterprise_linux:6::server | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::server | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvsRed Hat:enterprise_linux:6::workstation | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::workstation | before 0:1.11.23-11.el6_2.1 | 0:1.11.23-11.el6_2.1 |
cvsopenSUSE:Tumbleweed | before 1.12.12-183.10 | 1.12.12-183.10 |
What each source reports
NVD Score used
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
CVE-2012-0804- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
CVE-2012-0804- Updated
- 2026-11-02
EUVDEUVD-2012-0832No score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
EUVD-2012-0832- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fr3c-7j3p-qm6pNo score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12...
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
GHSA-fr3c-7j3p-qm6p- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2012-0804
CVE-2012-0804 does not affect BellSoft software
- Record
BELL-CVE-2012-0804- CVSS 2.0
- 10.0 Critical
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
OSVALPINE-CVE-2012-0804No score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
ALPINE-CVE-2012-0804- Updated
- 2026-11-03
OSVNo score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
CVE-2012-0804- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0804No score
Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response.
- Record
DEBIAN-CVE-2012-0804- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10504-1No score
cvs-1.12.12-183.10 on GA media
These are all security issues fixed in the cvs-1.12.12-183.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10504-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2012-02/msg00064.html
securitytracker.com/id?1026719
secunia.com/advisories/48150
exchange.xforce.ibmcloud.com/vulnerabilities/73097
rhn.redhat.com/errata/RHSA-2012-0321.html
mandriva.com/security/advisories?name=MDVSA-2012:044
Show 20 moreShow less
osvdb.org/78987
ubuntu.com/usn/usn-1371-1
security.gentoo.org/glsa/201701-44
bugzilla.redhat.com/show_bug.cgi?id=784141
debian.org/security/2012/dsa-2407
securityfocus.com/bid/51943
nvd.nist.gov/vuln/detail/CVE-2012-0804
access.redhat.com/errata/RHSA-2012:0321
github.com/advisories/GHSA-fr3c-7j3p-qm6p
security.alpinelinux.org/vuln/CVE-2012-0804
docs.bell-sw.com/security/cves/CVE-2012-0804
security-tracker.debian.org/tracker/CVE-2012-0804
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0321.json
cve.org/CVERecord?id=CVE-2012-0804
suse.com/security/cve/CVE-2012-0804