Red Hat Security AdvisoryRHSA-2015:1633
subversion security update
Released 2015-08-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Optional (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7 +6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7 +6
- Red Hat Enterprise Linux Server (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7.ppc +1
- Red Hat Enterprise Linux Server Optional (v. 6) subversion-devel-1.6.11-15.el6_7, subversion-devel-1.6.11-15.el6_7.ppc, subversion-gnome-1.6.11-15.el6_7 +10
- Red Hat Enterprise Linux Workstation (v. 6) mod_dav_svn-1.6.11-15.el6_7, subversion-1.6.11-15.el6_7, subversion-javahl-1.6.11-15.el6_7
- Red Hat Enterprise Linux Workstation Optional (v. 6) subversion-devel-1.6.11-15.el6_7, subversion-gnome-1.6.11-15.el6_7, subversion-kde-1.6.11-15.el6_7 +3
Fixes 3 records
Priority LOW 37
The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combination…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.12754 · Published 2015-04-08 · Partial fix CWE-399
Priority LOW 29
The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.
CVSS 2.0MEDIUM 4.0· Network · Low privileges · Interaction — · EPSS 0.07889 · Published 2015-04-08 · Partial fix CWE-345
Priority LOW 28
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by rea…
CVSS 2.0MEDIUM 4.0· Network · Low privileges · Interaction — · EPSS 0.06564 · Published 2015-08-12 · Partial fix CWE-200
THREATIST.IORead the docs