subversion - security update

2015-08-1600:00:00

Google

osv.dev

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

45.2%

JSON

C. Michael Pilato, from CollabNet, reported an issue in the version
control system Subversion.

CVE-2015-3187
Subversion servers revealed some sensible paths hidden by path-based
authorization. Remote authenticated users were allowed to obtain
path information by reading the history of a node that has been
moved from a hidden path. The vulnerability only revealed the path,
though it didn’t reveal its content.

For Debian 6 Squeeze, this issue has been fixed in subversion
1.6.12dfsg-7+deb6u3. We recommend to upgrade your subversion packages.

CPENameOperatorVersion
subversioneq1.6.12dfsg-4
subversioneq1.6.12dfsg-5
subversioneq1.6.12dfsg-5~bpo50+1
subversioneq1.6.12dfsg-6
subversioneq1.6.12dfsg-6~bpo50+1
subversioneq1.6.12dfsg-7

Name	Operator	Version
subversion	eq	1.6.12dfsg-4
subversion	eq	1.6.12dfsg-5
subversion	eq	1.6.12dfsg-5~bpo50+1
subversion	eq	1.6.12dfsg-6
subversion	eq	1.6.12dfsg-6~bpo50+1
subversion	eq	1.6.12dfsg-7