SUSE-SU-2016:1511-1 Security update for subversion

This update for subversion fixes the following issues: - CVE-2015-3187: svnrepostracenodelocations reveals paths hidden by authz bsc939517 - CVE-2016-2167: modauthzsvn: DoS in MOVE/COPY authorization check bsc976849 - CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm...

SUSE-SU-2016:1249-1 Security update for subversion

This update for subversion fixes the following issues: - CVE-2016-2167: modauthzsvn: DoS in MOVE/COPY authorization check bsc976849 - CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm bsc976850 The following non-security bugs were fixed: - bsc969159: subversion dependencie...

subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4

It was found that the modauthzsvn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to...

SUSE-SU-2015:1473-1 Security update for subversion

subversion was updated to fix two security issues. These security issues were fixed: - CVE-2015-3187: Information leak only paths that were hidden by path-based authz bsc939517. - CVE-2015-3184: Information leak in mixed anonymous/authenticated httpd dav configurations bsc939514...

CVE-2015-0251

The moddavsvn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences...

CVE-2007-2448

Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information revision properties via svn 1 propget, 2 proplist, or 3 propedit...

CVE-2004-1438

The modauthzsvn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command...

subversion -- WebDAV fails to protect metadata

In some situations, subversion metadata may be unexpectedly disclosed via WebDAV. A subversion advisory states: modauthzsvn, the Apache httpd module which does path-based authorization on Subversion repositories, is not correctly protecting all metadata on unreadable paths. This security issue is...

Fedora Core 2 : subversion-1.0.6-1 (2004-231)

This update includes the latest release of Subversion, including a security fix for an issue in the modauthzsvn Apache authentication module which could allow a read restriction for a portion of the repository to be bypassed by a user who has write access to a different portion of the repository...

void.at - neon format string bugs

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 VSA0401 - neon - void.at security notice Overview ======== We have discovered a format string vulnerability in neon http://www.webdav.org/neon. neon is a webdav client library, used by Subversion and others. CVE has assigned the name CAN-2004-0179 to...