2577 matches found
SUSE-SU-2017:2163-1 Security update for subversion
This update for subversion fixes the following issue: - CVE-2016-8734: Unrestricted XML entity expansion in moddontdothat and Subversion clients using https:// bsc1011552. - CVE-2017-9800: client code execution via argument injection in SSH URL bnc1051362...
Debian DLA-1052-1 : subversion security update
It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious 'svn+ssh' URLs in 'svn:externals' and 'svn:sync-from-url'. For Debian 7 'Wheezy', this issue has been fixed in subversion version 1.6.17dfsg-4+deb7u12. We recommend th...
Slackware 14.0 / 14.1 / 14.2 / current : subversion (SSA:2017-223-04)
New subversion packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2017-223-04. The text itself is...
Apache Subversion Remote Code Execution Vulnerability
Subversion is an open source multi-user version control system that supports non-ASCII text and binary data. A security vulnerability in the Subversion client's handling of svn+ssh:// URLs allows remote attackers to exploit the vulnerability to construct malicious requests that can execute...
FreeBSD : subversion -- Arbitrary code execution vulnerability (6e80bd9b-7e9b-11e7-abfe-90e2baa3bafc)
subversion team reports : A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL...
Ubuntu: Security Advisory (USN-3388-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[slackware-security] subversion
New subversion packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/subversion-1.9.7-i586-1slack14.2.txz: Upgraded. Fixed client side arbitrary code execution vulnerability. For more...
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
Design/Logic Flaw
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
ALPINE-CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
DEBIAN-CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
CVE-2017-9800
CVE-2017-9800 : A malicious svn+ssh URL could cause Subversion clients to execute an arbitrary shell command. Affected are Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3. The issue arises from improper handling/input validation of svn+ssh URLs, and a mali...
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server to attack another...
[SECURITY] [DLA 1052-1] subversion security update
Package : subversion Version : 1.6.17dfsg-4+deb7u12 CVE ID : CVE-2017-9800 It was discovered that there was a arbitrary code execution vulnerability in the subversion revision control system via malicious "svn+ssh" URLs in "svn:externals" and "svn:sync-from-url". For Debian 7 "Wheezy", this issue...
USN-3388-1 subversion vulnerabilities
Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. CVE-2017-9800 Daniel Shahaf and James McCoy...
USN-3388-1: Subversion vulnerabilities
Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. CVE-2017-9800 Daniel Shahaf and James McCoy...
Debian DSA-3932-1 : subversion - security update
Several problems were discovered in Subversion, a centralised version control system. - CVE-2016-8734 jessie only Subversion's moddontdothat server module and Subversion clients using https:// were vulnerable to a denial-of-service attack caused by exponential XML entity expansion. - CVE-2017-980...