Debian Subversion vulnerabilities

CVE-2011-1752 [MEDIUM] CVE-2011-1752: subversion - The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subv... The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011. Scope: local bookworm: resolved (fixed in 1.6.17dfsg-1) bullseye: resolved (fixed

CVE-2004-0397 [HIGH] CVE-2004-0397: subversion - Stack-based buffer overflow during the apr_time_t data conversion in Subversion ... Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command. Scope: local bookworm: resolved (fixed in 1.0.3-1) bullseye: resolved (fixed in 1.0.3-1) forky: resolved (fixed in 1.0.3-1) sid: resolved (fixed in

CVE-2013-2088 [HIGH] CVE-2013-2088: subversion - contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows rem... contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename. Scope: local bookworm: resolved (fixed in 1.7.5-1) bullseye: resolved (fixed in 1.7.5-1) forky: resolved (fixed in 1.7.5-1) sid: resolved (fixed in 1.7.5-1) trixie: reso

CVE-2015-5259 [HIGH] CVE-2015-5259: subversion - Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apach... Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. Scope: local bookworm: resolved (fixed in 1.9.3-1) bullseye: resolved (fixed in 1.9.3-1) forky: resolve

CVE-2017-9800 [CRITICAL] CVE-2017-9800: subversion - A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1... A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The v

CVE-2013-1847 [MEDIUM] CVE-2013-1847: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 an... The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. Scope: local bookworm: resolved (fixed in 1.7.9-1) bullseye: resolved (fixed in 1.7.9-1) forky: resolved (fixed in 1.7.9

CVE-2013-1884 [MEDIUM] CVE-2013-1884: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 all... The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable. Scope: local bookworm: resolved (fixed in 1.7.9-1) bullseye: resolved (fixed in 1.7.9-1) forky: resol

CVE-2018-11803 [HIGH] CVE-2018-11803: subversion - Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.... Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation. Scope: local bookworm: resolved (fixed in 1.10.4-1) bullseye: resolved (fixed in 1.10.4-1) forky: resolved (fixed in 1.10.4-1) sid: resolved (fixed i

CVE-2020-17525 [HIGH] CVE-2020-17525: subversion - Subversion's mod_authz_svn module will crash if the server is using in-repositor... Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.

CVE-2015-5343 [HIGH] CVE-2015-5343: subversion - Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x befo... Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow. Scop

CVE-2016-2167 [MEDIUM] CVE-2016-2167: subversion - The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion... The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string. Scope: local bookworm: resolved (fixed in 1.9.4-1)

CVE-2022-24070 [HIGH] CVE-2022-24070: subversion - Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up pa... Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected. Scope: local bookworm: resolved (fixed in 1.14.2-1

CVE-2009-2411 [HIGH] CVE-2009-2411: subversion - Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.... Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412. Scope: local bookworm: resolved (fixed in 1.6.4dfsg-1

CVE-2016-2168 [MEDIUM] CVE-2016-2168: subversion - The req_check_access function in the mod_authz_svn module in the httpd server in... The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check. Scope: local bookworm: resolved (fixed

CVE-2019-0203 [HIGH] CVE-2019-0203: subversion - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subver... In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server. Scope: local bookworm: resolved (fixed in 1.10.6-1) bullseye: resolved (fixed in 1.10.6-1) forky: resolved (fixed in 1.10.6-1) sid: re

CVE-2015-0202 [HIGH] CVE-2015-0202: subversion - The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attacker... The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes. Scope: local bookworm: resolved (fixed in 1.8.10-6) bullseye: resolved (fixed in 1.8.10-6) forky: resolved (fixed in 1.8.10-6) sid: resolved (

CVE-2004-0413 [CRITICAL] CVE-2004-0413: subversion - libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn... libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 1.0.5-1)

CVE-2010-3315 [MEDIUM] CVE-2010-3315: subversion - authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in ... authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands. Scope: local bookworm

CVE-2013-2112 [HIGH] CVE-2013-2112: subversion - The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows r... The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection. Scope: local bookworm: resolved (fixed in 1.7.9-1+nmu2) bullseye: resolved (fixed in 1.7.9-1+nmu2) forky: resolved (fixed in 1.7.9-1+nmu2) sid: resolved (fixed in 1.7.9-1+nmu2) trixie: resolved (fixed in 1.7.9

CVE-2015-3184 [MEDIUM] CVE-2015-3184: subversion - mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, ... mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Scope: local bookworm: resolved (fixed in 1.9.0-1) bullseye: resolved (fixed in 1.9.0-1) forky: resolved (fixed in 1.9.0-1) sid: reso