CVE-2013-1846

CVE-2013-1846 affects Subversion’s mod_dav_svn (Apache httpd). Priviledge: remote authenticated user. Vulnerable: Subversion 1.6.x before 1.6.21 and 1.7.0–1.7.8; impact: crashes via LOCK requests against activity URLs (denial of service). Mitigation: upgrade to Subversion 1.6.21 or 1.7.9 (or late...

CVE-2013-1845

CVE-2013-1845 affects Subversion, specifically mod_dav_svn, where a remote authenticated user can trigger a denial of service by setting or deleting a large number of properties. Vulnerable versions are Subversion 1.6.x prior to 1.6.21 and 1.7.0 through 1.7.8. The issue causes memory exhaustion/D...

CVE-2013-1849

Subversion's mod_dav_svn (Apache httpd) is affected by CVE-2013-1849: a denial-of-service caused by a NULL pointer dereference triggered by a PROPFIND request for an activity URL. Affected versions are Subversion 1.6.x up to 1.6.20 and 1.7.0 through 1.7.8. No explicit patch or fixed version is pr...

CVE-2013-2088

CVE-2013-2088 affects Subversion where the pre-commit hook script caused by the file name containing shell metacharacters in contrib/hook-scripts/svn-keyword-check.pl can allow remote authenticated users with commit permissions to execute arbitrary commands. Public references and exploits (e.g., ...

CVE-2013-2112

Subversion vulnerability CVE-2013-2112 affects svnserve in Subversion versions prior to 1.6.23 and 1.7.x prior to 1.7.10. The issue allows remote attackers to cause a denial of service (svnserve exit) by aborting a connection. Documented impact is a DoS affecting the svnserve daemon when handling...

CVE-2013-4558

CVE-2013-4558 affects Subversion’s mod_dav_svn in Apache HTTPD when built with assertions and SVNAutoversioning enabled, allowing remote DoS via a non-canonical URL (trailing /). Affected versions: Subversion 1.7.11–1.7.13 and 1.8.1–1.8.4. Root cause: assertion triggered by non-canonical requests...

CVE-2013-1968

CVE-2013-1968 affects Subversion with FSFS repositories, where a newline in a filename can be exploited to corrupt the repository and cause denial of service. Public reports from multiple vendors describe vulnerable ranges as Subversion releases before 1.6.23 and 1.7.x before 1.7.10. Connected ad...

CVE-2013-1847

CVE-2013-1847 is a denial-of-service in Subversion via the mod_dav_svn Apache HTTPD module. The issue occurs when an anonymous LOCK is issued for a URL that does not exist, triggering crashes (NULL pointer dereference) in vulnerable Subversion versions. Affected are Subversion mod_dav_svn on Apac...

CVE-2013-4277

CVE-2013-4277 affects Svnserve in Apache Subversion; affected versions are 1.4.0–1.7.12 and 1.8.0–1.8.1. Local users can overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. Root cause: symlink race on pid-file handling. Impact...

CVE-2013-4505

CVE-2013-4505 affects Apache Subversion: is_this_legal bypasses access restrictions in mod_dontdothat, enabling a remote attacker to trigger resource consumption/DoS via a crafted relative URL in a REPORT request for Subversion 1.4.0–1.7.13 and 1.8.0–1.8.4. Public advisories and OpenVAS/Nessus pl...

CVE-2013-4131

CVE-2013-4131 affects Subversion’s mod_dav_svn in the Apache httpd module. Versions 1.7.0–1.7.10 and 1.8.x prior to 1.8.1 can be remotely triggered by authenticated users through certain COPY, DELETE, or MOVE requests against a revision root to cause a denial of service (assertion failure or out-...

CVE-2013-1884

CVE-2013-1884 affects Subversion's mod_dav_svn for Apache httpd. In Subversion 1.7.0–1.7.8, a log REPORT request with an invalid limit can trigger an access of an uninitialized variable, causing a denial of service (segmentation fault/crash). Exploitation context: remote attacker via HTTP. The re...