CVE-2010-3846

Description

Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.

How to fix CVE-2010-3846

To remediate CVE-2010-3846, upgrade the affected package to a fixed version below.

• Alpine/cvs—upgrade to 1.12.12-r0 or later

Is CVE-2010-3846 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.12.12-r0

References (1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2010-3846