Integer overflow in the \Max-dotdot\ CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8 and 1.11.x through 1.11.16 may allow remote attackers to cause a server crash which could cause temporary data to remain undeleted and consume disk space.