CVE-2004-0413

2004-08-0604:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2004-0413

nvd

subversion

url handling

vulnerability

integer overflow

memory consumption

heap-based buffer overflow

remote code execution

7.9 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.315 Low

EPSS

Percentile

97.0%

JSON

libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.

CPENameOperatorVersion
openpkg:openpkgopenpkgeq2.0
subversion:subversionsubversioneq1.0.4
subversion:subversionsubversioneq1.0.2
subversion:subversionsubversioneq1.0.1
subversion:subversionsubversioneq1.0
subversion:subversionsubversioneq1.0.3
openpkg:openpkgopenpkgeq*

CPE	Name	Operator	Version
openpkg:openpkg	openpkg	eq	2.0
subversion:subversion	subversion	eq	1.0.4
subversion:subversion	subversion	eq	1.0.2
subversion:subversion	subversion	eq	1.0.1
subversion:subversion	subversion	eq	1.0
subversion:subversion	subversion	eq	1.0.3
openpkg:openpkg	openpkg	eq	*