CVE-2005-2693

Published: Aug 26, 2005Modified: Apr 16, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

cvsbug in CVS 1.12.12 and earlier creates temporary files insecurely, which allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack.

Affected (1)

Products: Cvs: Cvs

Cvs

1 product

Cvs

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cvs Cvs	Version 1.12.12

References (18)

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:20.cvsbug.asc (unsafe URL)

Source: secalert@redhat.com

http://secunia.com/advisories/16765

Source: secalert@redhat.com

http://securitytracker.com/id?1014857

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-802

Source: secalert@redhat.com

http://www.debian.org/security/2005/dsa-806

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2005-756.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2005/1667

Source: secalert@redhat.com

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=166366

Source: secalert@redhat.com

Patch

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10835

Source: secalert@redhat.com

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:20.cvsbug.asc (unsafe URL)