CVE-2013-4277

CVE-2013-4277 affects Svnserve in Apache Subversion; affected versions are 1.4.0–1.7.12 and 1.8.0–1.8.1. Local users can overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. Root cause: symlink race on pid-file handling. Impact...

CVE-2013-4277

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option...

CVE-2013-4277

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option...

CVE-2013-4277: Undefined Security Weakness

Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option...

PT-2013-5046

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.13 Apache Subversion versions 1.8.0 through 1.8.4 Description The issue allows remote attackers to bypass intended access restrictions and possibly cause a denial of service via a relative URL in a...

Updated subversion package fixes security vulnerability.

svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a...

MGASA-2013-0275 Updated subversion package fixes security vulnerability.

svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destination could be replaced by a...

PT-2013-4932

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.12 Apache Subversion versions 1.8.0 through 1.8.1 Description The issue allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the...

Fedora Update for subversion FEDORA-2013-15717

Check for the Version of subversion OpenVAS Vulnerability Test Fedora Update for subversion FEDORA-2013-15717 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for subversion FEDORA-2013-15717

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] subversion (SSA:2013-251-01)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 slackware-security subversion SSA:2013-251-01 New subversion packages are available for Slackware 14.0 and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: +--------------------------+...

Subversion symbolic links vulnerabilitiy

Privilege escalation via symbolic links...

Slackware 14.0 / current : subversion (SSA:2013-251-01)

New subversion packages are available for Slackware 14.0 and -current to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2013-251-01. The text itself is copyright C...

[slackware-security] subversion

New subversion packages are available for Slackware 14.0 and -current to fix a security issue. Here are the details from the Slackware 14.0 ChangeLog: patches/packages/subversion-1.7.13-i486-1slack14.0.txz: Upgraded. This update fixes a local privilege escalation vulnerability via symlink attack...

[SECURITY] Fedora 19 Update: subversion-1.7.13-1.fc19

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file...

Fedora 19 : subversion-1.7.13-1.fc19 (2013-15717)

This update includes the latest stable release of Apache Subversion 1.7, version 1.7.13. One security vulnerability is fixed in this update : svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has...

httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav

moddav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service segmentation fault via a MERGE request in which the URI is configured for handling by the moddavsvn module, but a certain href...

Medium: subversion

Issue Overview: The moddavsvn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service assertion failure or out-of-bounds read via a certain 1 COPY, 2 DELETE, or 3 MOVE request against a revision root...

Amazon Linux AMI : subversion (ALAS-2013-180)

A NULL pointer dereference flaw was found in the way the moddavsvn module handled PROPFIND requests on activity URLs. A remote attacker could use this flaw to cause the httpd process serving the request to crash. CVE-2013-1849 A flaw was found in the way the moddavsvn module handled large numbers...

svnserve is vulnerable to a local privilege escalation vulnerability via symlink attack.

Subversion Project reports: svnserve takes a --pid-file option which creates a file containing the process id it is running as. It does not take steps to ensure that the file it has been directed at is not a symlink. If the pid file is in a directory writeable by unprivileged users, the destinati...