CVE-2004-0418

serve_notify in CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle empty data lines, which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.

• ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc
• ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
• http://marc.info/?l=bugtraq&m=108716553923643&w=2
• http://security.e-matters.de/advisories/092004.html
• http://security.gentoo.org/glsa/glsa-200406-06.xmlVendor Advisory
• http://www.debian.org/security/2004/dsa-519Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:058
• http://www.redhat.com/support/errata/RHSA-2004-233.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1003
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11242
• ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc
• ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-June/022441.html
• http://marc.info/?l=bugtraq&m=108716553923643&w=2
• http://security.e-matters.de/advisories/092004.html
• http://security.gentoo.org/glsa/glsa-200406-06.xmlVendor Advisory
• http://www.debian.org/security/2004/dsa-519Patch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:058
• http://www.redhat.com/support/errata/RHSA-2004-233.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1003
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11242

Published

Aug 6, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-0412Mailman before 2.1.5 allows remote attackers to obtain user …
• CVE-2004-0413libsvn_ra_svn in Subversion 1.0.4 trusts the length field of…
• CVE-2004-0414CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does …
• CVE-2004-0415Linux kernel does not properly convert 64-bit file offset po…
• CVE-2004-0416Double free vulnerability for the error_prog_name string in …
• CVE-2004-0417Integer overflow in the "Max-dotdot" CVS protocol command (s…
• CVE-2004-0419XDM in XFree86 opens a chooserFd TCP socket even when Displa…
• CVE-2004-0420The Windows Shell application in Windows 98, Windows ME, Win…
• CVE-2004-0421The Portable Network Graphics library (libpng) 1.0.15 and ea…
• CVE-2004-0422flim before 1.14.3 creates temporary files insecurely, which…
• CVE-2004-0423The log_event function in ssmtp 2.50.6 and earlier allows lo…
• CVE-2004-0424Integer overflow in the ip_setsockopt function in Linux kern…