SECURITY BUG in CVS 1.11.1

[Larry Jones]

It has been brought to my attention that CVS 1.11.1 and 1.11.1p1 have a
bug in pserver mode that allows read-only users to run the "tag"
command.  This allows read-only users to add and, more importantly, move
or delete tags.  The bug does not affect releases prior to 1.11.1 and
has been fixed in the current development version.  Anyone with a
publicly-accessible pserver (or clumsy users) is urged to upgrade
immediately.

-Larry Jones

I don't think math is a science, I think it's a religion. -- Calvin