CVE-2014-0032

CVE-2014-0032 affects the Apache Subversion mod_dav_svn module. When SVNListParentPath is enabled, get_resource in repos.c allows remote attackers to trigger a crash (DoS) by sending requests with the server root and non-GET methods (e.g., svn ls http://svn.example.com). Affected are Subversion v...

CVE-2014-3580

CVE-2014-3580 affects the mod_dav_svn component of Apache Subversion (1.x) prior to 1.7.19 and 1.8.x prior to 1.8.11. A remote attacker can trigger a NULL pointer dereference via a REPORT request for a non-existent resource , causing a denial of service and server crash. Connected sources documen...

CVE-2014-3528

CVE-2014-3528 affects Apache Subversion: cached credentials are protected by an MD5 hash of the URL and authentication realm. Subversion 1.0.0–1.7.x (before 1.7.17) and 1.8.x (before 1.8.10) store credentials in this manner, which may allow a remote server to obtain credentials via a crafted auth...

CVE-2014-3522

The CVE-2014-3522 vulnerability affects Subversion’s Serf RA layer, where wildcards in X.509 CN/subjectAltName are not properly validated, enabling MITM certificate spoofing. Affected: Subversion Serf-based TLS for versions 1.4.0–1.7.x before 1.7.18 and 1.8.x before 1.8.10. Impact: potential disc...

CVE-2014-8108

The CVE-2014-8108 issue affects the Apache Subversion mod_dav_svn module. According to connected docs, Subversion 1.7.x is vulnerable before 1.7.19 and 1.8.x is vulnerable before 1.8.11, where a remote attacker can trigger a NULL pointer dereference by requesting a URI that causes a lookup for a ...

CVE-2014-3504

CVE-2014-3504 (Serf) affects the Serf SSL certificate handling in Serf 0.2.0–1.3.x prior to 1.3.7, where a NUL byte in a domain name within the certificate’s subject CN could allow a remote attacker to spoof an SSL server (MITM). The issue stems from improper parsing/validation of CN in X.509 cer...

CVE-2013-4262

CVE-2013-4262 concerns Subversion 1.8.0–1.8.3 where the --pidfile option, used with svnwcsub.py, permits local privilege escalation via a symlink attack on the pid file when running in foreground. The related CVE-2013-7393 covers the daemonize.py path that enables privilege gains for either svnwc...

CVE-2013-7393

CVE-2013-7393 affects the Subversion daemonize.py module and applies to Subversion 1.8.0 before 1.8.2. The issue allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. The description notes th...