openSUSE Security Update : subversion (openSUSE-2015-549)

subversion was updated to version 1.8.14 to fix two security issues. These security issues were fixed : - CVE-2015-3187: Information leak only paths that were hidden by path-based authz bsc939517. - CVE-2015-3184: Information leak in mixed anonymous/authenticated httpd dav configurations bsc93951...

Scientific Linux Security Update : subversion on SL6.x i386/x86_64 (20150817)

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server both svnserve and httpd with the moddavsvn module to crash. CVE-2015-0248 It was found that the...

RHEL 6 : subversion (RHSA-2015:1633)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1633 advisory. Subversion SVN is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarc...

CentOS 6 : subversion (CESA-2015:1633)

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

Oracle Linux 6 : subversion (ELSA-2015-1633)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1633 advisory. 1.6.11-15 - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3187 Tenable has extracted the preceding description block directly from the...

CentOS Update for mod_dav_svn CESA-2015:1633 centos6

Check the version of moddavsvn SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882252";...

RedHat Update for subversion RHSA-2015:1633-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Subversion Multiple Vulnerabilities (Aug 2015)

Apache Subversion is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:subversion";...

mod_dav_svn, subversion security update

CentOS Errata and Security Advisory CESA-2015:1633 Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

Moderate: Red Hat Security Advisory: subversion security update

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

subversion: (mod_dav_svn) spoofing svn:author property values for new revisions

It was found that the moddavsvn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property...

subversion: svn_repos_trace_node_locations() reveals paths hidden by authz

It was found that when an SVN server both svnserve and httpd with the moddavsvn module searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable for example, if it had been moved...

subversion: (mod_dav_svn) remote denial of service with certain requests with dynamically evaluated revision numbers

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server both svnserve and httpd with the moddavsvn module to crash...

subversion security update

1.6.11-15 - add security fixes for CVE-2015-0248, CVE-2015-0251, CVE-2015-3187...

Debian DLA-293-1 : subversion security update

C. Michael Pilato, from CollabNet, reported an issue in the version control system Subversion. CVE-2015-3187 Subversion servers revealed some sensible paths hidden by path-based authorization. Remote authenticated users were allowed to obtain path information by reading the history of a node that...

[SECURITY] [DLA 293-1] subversion security update

Package : subversion Version : 1.6.12dfsg-7+deb6u3 CVE ID : CVE-2015-3187 C. Michael Pilato, from CollabNet, reported an issue in the version control system Subversion. CVE-2015-3187 Subversion servers revealed some sensible paths hidden by path-based authorization. Remote authenticated users wer...

DLA-293-1 subversion - security update

Bulletin has no description...

subversion: authentication bypass

CVE-2015-3184: Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. The result is that anonymous access may be possible to files for which only authenticated access should be possible. - CVE-2015-3187:...

Debian DSA-3331-1 : subversion - security update

Several security issues have been found in the server components of the version control system subversion. - CVE-2015-3184 Subversion's modauthzsvn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. The result is that...

CVE-2015-3187

The svnrepostracenodelocations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path...