subversion: authentication bypass

• CVE-2015-3184:

Subversion’s mod_authz_svn does not properly restrict anonymous access
in some mixed anonymous/authenticated environments when using Apache
httpd 2.4. The result is that anonymous access may be possible to files
for which only authenticated access should be possible.

• CVE-2015-3187:

Subversion servers, both httpd and svnserve, will reveal some paths that
should be hidden by path-based authz. When a node is copied from an
unreadable location to a readable location the unreadable path may be
revealed. This vulnerability only reveals the path, it does not reveal
the contents of the path.