IBM Information for VU#650937

Concurrent Versions System (CVS) server improperly deallocates memory

Status

Affected

Vendor Statement

The AIX operating system does not ship with CVS. However, CVS is available for installation on AIX from the Linux Affinity Toolbox.

CVS versions 1.11.1p1-2 and earlier are vulnerable to the issues discussed in CERT Vulnerability Note VU#650937 and any advisories which follow.

Users are advised to download CVS 1.11.1p1-3 from:

ftp://ftp.software.ibm.com/aix/freeSoftware/aixtoolbox/RPMS/ppc/cvs/
cvs-1.11.1p1-3.aix4.3.ppc.rpm

Please note that the above address was wrapped to two lines.

CVS 1.11.1p1-3 contains the security fixes made in CVS 1.11.5 to address these issues.

This software is offered on an "as-is" basis.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.