Stable CVS 1.11.15 has been released. Stable releases contain only
bug fixes from previous versions of CVS. This version fixes serious
security holes in both the client and the CVS server executables
as well as fixing many other bugs, including some file resurrection
issues. We recommend this upgrade for all CVS clients and servers!
from GENTOO LINUX SECURITY ANNOUNCEMENT 200312-08
"Stable CVS 1.11.11 has been released. Stable releases contain only
bug fixes from previous versions of CVS. This release adds code to
the CVS server to prevent it from continuing as root after a user
login, as an extra failsafe against a compromise of the
CVSROOT/passwd file. Previously, any user with the ability to write
the CVSROOT/passwd file could execute arbitrary code as the root
user on systems with CVS pserver access enabled. We recommend this
upgrade for all CVS servers!"