CVE-2004-0418 in CVS
Summary
serve_notify in cvs 1.12.x through 1.12.8 and 1.11.x through 1.11.16 does not properly handle empty data lines which may allow remote attackers to perform an "out-of-bounds" write for a single byte to execute arbitrary code or modify critical program data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.