Cvsup is a networked file-synchronization utility primarily used for distributing and mirroring software repositories, with a narrow product portfolio centered on the cvsup client and mirror variants. The vendor's disclosed vulnerabilities cluster around improper link resolution and file-access handling, reflecting risks inherent to local filesystem operations in a network synchronization context. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Cvsup over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2002-2382HIGH cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out. | Dec 31, 2002 | 7.2 | 18 | NO | NO |
CVE-2004-2133MEDIUM Certain third-party packages for CVSup 16.1h, such as SuSE Linux, contain untrusted paths in the ELF RPATH fields of certain executables, which could allow local users to execute a | Jan 29, 2004 | 4.6 | 14 | NO | NO |
CVE-2003-0606MEDIUM sup 1.8 and earlier does not properly create temporary files, which allows local users to overwrite arbitrary files. | Aug 27, 2003 | 4.6 | 14 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Cvsup.
Media articles that mention a CVE ID that affects a product developed by Cvsup — matched by CVE ID, not by vendor name.