CVE-2010-3846
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to...
CVE-2010-3846 is a medium vulnerability (CVSS 6.9) in Nongnu Cvs, published November 5, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 33rd percentile. Fixed in cvs 1.12.12-r0.
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
CVE-2010-3846- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
CVE-2010-3846- Updated
- 2026-11-02
EUVDEUVD-2010-3825 No score
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
EUVD-2010-3825- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxxv-8qg4-6qv9 No score
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to...
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
GHSA-xxxv-8qg4-6qv9- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVBELL-CVE-2010-3846
CVE-2010-3846 does not affect BellSoft software
- Record
BELL-CVE-2010-3846- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
OSVALPINE-CVE-2010-3846 No score
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
ALPINE-CVE-2010-3846- Updated
- 2026-11-03
OSV No score
Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
- Record
CVE-2010-3846- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.10 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.11 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.12 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.13 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.14 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.15 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.16 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.17 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.18 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.19 |
before 1.12.12-r0 | 1.12.12-r0 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.20 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.21 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.22 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.23 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.24 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.8 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.9 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsRed Hat:enterprise_linux:6::client |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvsRed Hat:enterprise_linux:6::computenode |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvsRed Hat:enterprise_linux:6::server |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvsRed Hat:enterprise_linux:6::workstation |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
cvs-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.11.23-11.el6_0.1 | 0:1.11.23-11.el6_0.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/42041
lists.fedoraproject.org/pipermail/package-announce/2010-October/050090.html
vupen.com/english/advisories/2010/2846
securityfocus.com/bid/44528
Show 21 moreShow less
osvdb.org/68952
exchange.xforce.ibmcloud.com/vulnerabilities/62858
securitytracker.com/id?1024795
bugzilla.redhat.com/show_bug.cgi?id=642146
cvs.savannah.gnu.org/viewvc/cvs/ccvs/src/rcs.c?r1=1.262.4.65&r2=1.262.4.66&sortby=rev
redhat.com/support/errata/RHSA-2010-0918.html
nvd.nist.gov/vuln/detail/CVE-2010-3846
access.redhat.com/errata/RHSA-2010:0918
github.com/advisories/GHSA-xxxv-8qg4-6qv9
security.alpinelinux.org/vuln/CVE-2010-3846
docs.bell-sw.com/security/cves/CVE-2010-3846
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0918.json
cve.org/CVERecord?id=CVE-2010-3846