Updated subversion package fixes security vulnerability.

2013-09-1400:14:09

Gentoo Foundation

advisories.mageia.org

3.3 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

5.3%

JSON

svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a symlink allowing for privilege escalation. svnserve does not create a pid file by default (CVE-2013-4277).

OSVersionArchitecturePackageVersionFilename
Mageia2noarchsubversion< 1.7.13-1subversion-1.7.13-1.mga2
Mageia3noarchsubversion< 1.7.13-1subversion-1.7.13-1.mga3