subversion -- DoS vulnerabilities

Subversion Project reports: Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests. Subversion moddavsvn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with...

Mandriva Linux Security Advisory : subversion (MDVSA-2015:085)

Updated subversion packages fix security vulnerabilities : The moddavsvn module in Apache Subversion before 1.8.8, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service crash via an OPTIONS request CVE-2014-0032. Ben Reser discovered that Subversion did not...

Debian DLA-136-1 : websvn security update

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as. NOTE: Tenable Netwo...

Debian DLA-119-1 : subversion security update

Evgeny Kotkov discovered a NULL pointer dereference while processing REPORT requests in moddavsvn, the Subversion component which is used to serve repositories with the Apache web server. A remote attacker could abuse this vulnerability for a denial of service. We recommend that you upgrade your...

Apple Xcode < 6.2 (Mac OS X)

The Apple Xcode installed on the remote Mac OS X host is prior to version 6.2. It is, therefore, affected by the following vulnerabilities : - Numerous errors exist related to the bundled version of Apache Subversion. CVE-2014-3522, CVE-2014-3528, CVE-2014-3580, CVE-2014-8108 - An error exists...

Scientific Linux Security Update : subversion on SL6.x i386/x86_64 (20150210)

A NULL pointer dereference flaw was found in the way the moddavsvn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash moddavsvn. CVE-2014-3580 It was discovered that Subversion clients retrieved cached authentication credential...

Scientific Linux Security Update : subversion on SL7.x x86_64 (20150210)

A NULL pointer dereference flaw was found in the way the moddavsvn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash moddavsvn. CVE-2014-3580 A NULL pointer dereference flaw was found in the way the moddavsvn module handled...

mod_dav_svn, subversion security update

CentOS Errata and Security Advisory CESA-2015:0166 Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

CentOS 7 : subversion (CESA-2015:0166)

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

CentOS 6 : subversion (CESA-2015:0165)

Updated subversion packages that fix two security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available f...

RedHat Update for subversion RHSA-2015:0166-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for mod_dav_svn CESA-2015:0166 centos7

Check the version of moddavsvn SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882116";...

CentOS Update for mod_dav_svn CESA-2015:0165 centos6

Check the version of moddavsvn SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882117";...

Oracle Linux 7 : subversion (ELSA-2015-0166)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0166 advisory. 1.7.14-7 - add security fixes for CVE-2014-3528, CVE-2014-3580, CVE-2014-8108 Tenable has extracted the preceding description block directly from the...

RHEL 7 : subversion (RHSA-2015:0166)

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

Oracle Linux 6 : subversion (ELSA-2015-0165)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0165 advisory. - moddavsvn fix for CVE-2014-3580 backport Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

RedHat Update for subversion RHSA-2015:0165-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

subversion: NULL pointer dereference flaw in mod_dav_svn when handling REPORT requests

A NULL pointer dereference flaw was found in the way the moddavsvn module handled REPORT requests. A remote, unauthenticated attacker could use a specially crafted REPORT request to crash moddavsvn...

subversion: credentials leak via MD5 collision

It was discovered that Subversion clients retrieved cached authentication credentials using the MD5 hash of the server realm string without also checking the server's URL. A malicious server able to provide a realm that triggers an MD5 collision could possibly use this flaw to obtain the...

Moderate: Red Hat Security Advisory: subversion security update

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...