CVE-2017-1000085

CVE-2017-1000085 affects the Jenkins Subversion Plugin. The vulnerability arises when the Subversion plugin connects to a user-specified repository during form validation, bypassing Item/Configure permissions and allowing users with Item/Build permission (but not Item/Configure) to have the plugi...

About the security content of Xcode 9

About the security content of Xcode 9 This document describes the security content of Xcode 9. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent...

GLSA-201709-09 : Subversion: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-201709-09 Subversion: Arbitrary code execution Specially crafted ssh://... URLs may allow the owner of the repository to execute arbitrary commands on clients machine if those commands are already installed on the clients system...

Subversion: Arbitrary code execution

Background Subversion is a version control system intended to eventually replace CVS. Like CVS, it has an optional client-server architecture where the server can be an Apache server running modsvn, or an ssh program as in CVS’s :ext: method. In addition to supporting the features found in CVS,...

The vulnerability of the svn:externals and svn:sync-from-url services in the centralized version control system Subversion allows a perpetrator to execute arbitrary shell commands.

The vulnerability of the svn:externals and svn:sync-from-url services in the centralized version control system Subversion exists due to insufficient checking of input data file://, http://, plain untunneled svn://. Exploiting this vulnerability allows a malicious actor to execute any shell comma...

jenkins-plugin-subversion: CSRF vulnerability and insufficient permission checks allow capturing credentials (SECURITY-303)

Subversion Plugin improperly checked permissions, requiring just Item/Build instead of Item/Configure when used. This allows a user to specify an attacker-controlled Subversion server which can then be used to collect credentials used by the Subversion plugin...

EulerOS 2.0 SP1 : subversion (EulerOS-SA-2017-1175)

According to the version of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to...

EulerOS 2.0 SP2 : subversion (EulerOS-SA-2017-1176)

According to the version of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to...

SourceTree Remote Code Execution Exploit

SourceTree suffers from multiple remote code execution vulnerabilities that can be triggered via hostile repositories being checked in. SourceTree for macOS versions prior to 2.6.1 and SourceTree for Windows versions prior to 2.1.10 are affected. SourceTree Remote Code Execution Exploit CVE ID:...

svn-workbench Command Execution Vulnerability

svn-workbench is a svn version control system visualization tool . A security vulnerability exists in svn-workbench and previous versions 1.6.2. The vulnerability can be exploited to execute arbitrary code via the 'Command Shell' menu item...

UBUNTU-CVE-2015-0853

svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$xeyes...

Amazon Linux AMI : subversion / mod_dav_svn (ALAS-2017-883)

Command injection through clients via malicious svn+ssh URLs A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for...

Important: subversion, mod_dav_svn

Issue Overview: Command injection through clients via malicious svn+ssh URLs A shell command injection flaw related to the handling of "svn+ssh" URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion...

Important Photon OS Security Update - PHSA-2017-0065

Updates of 'subversion' packages of Photon OS have been released...

Apache Subversion svn-ssh URL Command Execution (CVE-2017-9800)

A command execution vulnerability exists in Apache Subversion, due to improper processing of svn+ssh:// URLs. A remote attacker could exploit this vulnerability by enticing a user to checkout a malicious repository...

Fedora Update for subversion FEDORA-2017-1d1a38bdd1

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 7 : subversion (CESA-2017:2480)

An update for subversion is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Fedora 25 : subversion (2017-1d1a38bdd1)

This update includes the latest stable release of Apache Subversion, version 1.9.7. Client-side bugfixes : - Fix arbitrary code execution vulnerability CVE-2017-9800 See for details. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update...

[SECURITY] Fedora 25 Update: subversion-1.9.7-1.fc25

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file...

Scientific Linux Security Update : subversion on SL7.x x86_64 (20170816)

Security Fixes : - A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performing a 'checkout' or...