Security bugs are reported here via bugzilla

[George Sherwood <pilot AT beernabeer.com>]

Summary
============
CVS now uses version 1.2.3 of the ZLib compression libraries in order to 
avoid two recently announced security vulnerabilities in them.  Both may be 
used for denial of service attacks and one may reportedly allow execution of 
arbitrary code, though this is not confirmed.  Please see the CERT 
vulnerabilities advisories #238678 <http://www.kb.cert.org/vuls/id/238678> & 
#680620 <http://www.kb.cert.org/vuls/id/680620> for more.

Impact
======
A remote attacker be able to exploit this vulnerability by supplying the 
inflate() routine with specially crafted compressed data. As a result, 
applications linked to the zlib library may abruptly and abnormally terminate 
resulting in a denial-of-service condition. According to public reports, this 
vulnerability can be exploited to execute arbitrary code, but we have not 
confirmed this.

Solution:
=========

Update cvs as soon as possible to version 1.12.13.  There are no
fixes for older versions available.

Resolution
==========
All cvs users should upgrade to the latest available version:
        # scribe update
        # cast -c cvs

References
============
http://ftp.gnu.org/non-gnu/cvs/source/feature/1.12.13/NEWS
http://www.kb.cert.org/vuls/id/238678
http://www.kb.cert.org/vuls/id/680620