Debian Subversion vulnerabilities

CVE-2004-0749 [MEDIUM] CVE-2004-0749: subversion - The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restr... The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames. Scope: local bookworm: resolved (fixed in 1.0.9-2) bullseye: resolved (fixed

CVE-2013-4131 [MEDIUM] CVE-2013-4131: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 an... The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root. Scope: local bookworm: resolved (fixed in 1.7.13-1) bullseye: resolved (fixed

CVE-2013-4505 [LOW] CVE-2013-4505: subversion - The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through... The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request. Scope: local bookworm: resolved (fixed in 1.7.14-1) bullseye: resolved (fixed in 1.7.14-1)

CVE-2010-4644 [LOW] CVE-2010-4644: subversion - Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow rem... Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command. Scope: local bookworm: resolved (fixed in 1.6.12dfsg-3) bullseye: resolved (fixed in 1.6.12dfsg-3) forky: resolved (fixed in 1.6.12dfsg-3) sid: resolved (fix

CVE-2013-1845 [LOW] CVE-2013-1845: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and... The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory. Scope: local bookworm: resolved (fixed in 1.7.9-1) bullseye: resolved (fixed in 1.7.9-1) forky: re

CVE-2013-4277 [LOW] CVE-2013-4277: subversion - Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allow... Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. Scope: local bookworm: resolved (fixed in 1.7.13-1) bullseye: resolved (fixed in 1.7.13-1) forky: resolved (fixed in 1.7.13-1) sid: resolved (fixed

CVE-2006-1564 [MEDIUM] CVE-2006-1564: subversion - Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in ... Untrusted search path vulnerability in libapache2-svn 1.3.0-4 for Subversion in Debian GNU/Linux includes RPATH values under the /tmp/svn directory for the (1) mod_authz_svn.so and (2) mod_dav_svn.so modules, which might allow local users to gain privileges by installing malicious libraries in that directory. Scope: local bookworm: resolved (fixed in 1.3.0-5) bul

CVE-2004-1438 [LOW] CVE-2004-1438: subversion - The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remot... The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with write access to the repository, to read unauthorized parts of the repository via the svn copy command. Scope: local bookworm: resolved (fixed in 1.0.6-1) bullseye: resolved (fixed in 1.0.6-1) forky: resolved (fixed in 1.0.6-1) sid: resolved (fixed in 1.0.6-1)

CVE-2007-2448 [LOW] CVE-2007-2448: subversion - Subversion 1.4.3 and earlier does not properly implement the "partial access" pr... Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have access to changed paths but not copied paths, which allows remote authenticated users to obtain sensitive information (revision properties) via svn (1) propget, (2) proplist, or (3) propedit. Scope: local bookworm: resolved (fixed in 1.4.4dfsg1-1) bullseye: res

CVE-2013-7393 [LOW] CVE-2013-7393: subversion - The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to g... The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3). Scope: local bookworm: resolved (fixed in 1.8.5-1) bullseye:

CVE-2013-4262 [LOW] CVE-2013-4262: subversion - svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option an... svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-2013-7393. Scope: local bookworm: resolved (fixed in 1.8.5-1) bullsey