GLSA 200312-04: CVS: malformed module request vulnerability

Severity:translation missing: en, label_glsa_minimal
Title:CVS: malformed module request vulnerability
Bugs: #35371


A bug in cvs could allow attempts to create files and directories outside a repository.


CVS, which stands for Concurrent Versions System, is a client/server application which tracks changes to sets of files. It allows multiple users to work concurrently on files, and then merge their changes back into the main tree (which can be on a remote system). It also allows branching, or maintaining separate versions for files.

Affected packages

Package Vulnerable Unaffected Architecture(s)
dev-util/cvs <= 1.11.9 >= 1.11.10 All supported architectures


Quote from "Stable CVS 1.11.10 has been released. Stable releases contain only bug fixes from previous versions of CVS. This release fixes a security issue with no known exploits that could cause previous versions of CVS to attempt to create files and directories in the filesystem root. This release also fixes several issues relevant to case insensitive filesystems and some other bugs. We recommend this upgrade for all CVS clients and servers!"


Attempts to create files and directories outside the repository may be possible.


There is no known workaround at this time.


All Gentoo Linux machines with cvs installed should be updated to use dev-util/cvs-1.11.10 or higher:

    # emerge sync
    # emerge -pv '>=dev-util/cvs-1.11.10'
    # emerge '>=dev-util/cvs-1.11.10'
    # emerge clean



This GLSA and any updates to it are available for viewing at the Gentoo Security Website:


Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to or alternatively, you may file a bug at


Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

Thank you!