CVE-2015-5343

CWE-119 — Buffer OverflowCWE-190 — Integer OverflowCWE-122 — Heap-based Buffer OverflowCWE-125 — Out-of-bounds Read8 documents7 sources
Severity
7.6HIGH
EPSS
19.1%
top 4.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache SubversionDebian Debian Linux
Timeline
PublishedApr 14
Latest updateMay 14

Description

Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:HExploitability: 2.8 | Impact: 4.7

Affected Packages2 packages

▶NVDapache/subversion1.8.0 — 1.8.15+2
▶Debiansubversion< 1.9.3-1+3

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-g5xg-c32g-4v99: Integer overflow in util↗2022-05-14
▶
CVEList
CVE-2015-5343: Integer overflow in util↗2016-04-14
▶
OSV
CVE-2015-5343: Integer overflow in util↗2016-04-14
▶

📋Vendor Advisories

2
Red Hat
subversion: (mod_dav_svn) integer overflow when parsing skel-encoded request bodies↗2015-12-15
▶
Debian
CVE-2015-5343: subversion - Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x befo...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-5259 CVE-2015-5343 subversion: various flaws [fedora-all]↗2015-12-16
▶
Bugzilla
CVE-2015-5343 subversion: (mod_dav_svn) integer overflow when parsing skel-encoded request bodies↗2015-12-09
▶
CVE-2015-5343 (HIGH CVSS 7.6) | Integer overflow in util.c in mod_d | cvebase.io