what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2015-192

Mandriva Linux Security Advisory 2015-192
Posted Apr 3, 2015
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2015-192 - Multiple vulnerabilities has been discovered and corrected in subversion. Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests. Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers. Subversion HTTP servers allow spoofing svn:author property values for new revisions. The updated packages have been upgraded to the 1.7.20 and 1.8.13 versions where these security flaws has been fixed.

tags | advisory, web, denial of service, spoof, vulnerability
systems | linux, mandriva
advisories | CVE-2015-0202, CVE-2015-0248, CVE-2015-0251
SHA-256 | 829bf7383ff71da085f5217b201c2b0b0c211ea29983b39d9bc74aa6de7c36fc

Mandriva Linux Security Advisory 2015-192

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:192
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : subversion
Date : April 3, 2015
Affected: Business Server 1.0, Business Server 2.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in
subversion:

Subversion HTTP servers with FSFS repositories are vulnerable to a
remotely triggerable excessive memory use with certain REPORT requests
(CVE-2015-0202).

Subversion mod_dav_svn and svnserve are vulnerable to a remotely
triggerable assertion DoS vulnerability for certain requests with
dynamically evaluated revision numbers (CVE-2015-0248).

Subversion HTTP servers allow spoofing svn:author property values
for new revisions (CVE-2015-0251).

The updated packages have been upgraded to the 1.7.20 and 1.8.13
versions where these security flaws has been fixed.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251
http://subversion.apache.org/security/CVE-2015-0202-advisory.txt
http://subversion.apache.org/security/CVE-2015-0248-advisory.txt
http://subversion.apache.org/security/CVE-2015-0251-advisory.txt
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
431997d6c51445e6dfd80aa257d71cde mbs1/x86_64/apache-mod_dav_svn-1.7.20-1.mbs1.x86_64.rpm
be7ff8ab86b7d249c90e681ff94d7e5c mbs1/x86_64/lib64svn0-1.7.20-1.mbs1.x86_64.rpm
666178703664d199455b8a67e1f2e8d7 mbs1/x86_64/lib64svn-gnome-keyring0-1.7.20-1.mbs1.x86_64.rpm
3ce5845f3f36d40f4b61803ab22baad0 mbs1/x86_64/lib64svnjavahl1-1.7.20-1.mbs1.x86_64.rpm
adaf02401908f768d1a5ed1fae2a2845 mbs1/x86_64/perl-SVN-1.7.20-1.mbs1.x86_64.rpm
02c85a550542afc0ab22c05ccfe0a569 mbs1/x86_64/perl-svn-devel-1.7.20-1.mbs1.x86_64.rpm
a6b4145e35dcf218b2aaf9dfec09a071 mbs1/x86_64/python-svn-1.7.20-1.mbs1.x86_64.rpm
9efccfc610ce975e3fa056d0a96479ac mbs1/x86_64/python-svn-devel-1.7.20-1.mbs1.x86_64.rpm
5a7f2f8e3f82896a0336904b448b8e09 mbs1/x86_64/ruby-svn-1.7.20-1.mbs1.x86_64.rpm
99001923a24600d2e5f9d41a852d226a mbs1/x86_64/ruby-svn-devel-1.7.20-1.mbs1.x86_64.rpm
6ff89286c065648f4004941dcad80b7c mbs1/x86_64/subversion-1.7.20-1.mbs1.x86_64.rpm
7378f77b345dbdcb007ca85507fdf7f5 mbs1/x86_64/subversion-devel-1.7.20-1.mbs1.x86_64.rpm
d1c035d3757ab042971d47c8d8c1a936 mbs1/x86_64/subversion-doc-1.7.20-1.mbs1.x86_64.rpm
0dae2994b65b1795239d1d755e1ad853 mbs1/x86_64/subversion-gnome-keyring-devel-1.7.20-1.mbs1.x86_64.rpm
8a52bff9e69570d1444e289922712885 mbs1/x86_64/subversion-server-1.7.20-1.mbs1.x86_64.rpm
a13c7bc82cca7e21f3f709070c649fdd mbs1/x86_64/subversion-tools-1.7.20-1.mbs1.x86_64.rpm
ee3d0af44b559c0fcdc39899ed468722 mbs1/x86_64/svn-javahl-1.7.20-1.mbs1.x86_64.rpm
d35a59dacee19678345bca7f62a9dc43 mbs1/SRPMS/subversion-1.7.20-1.mbs1.src.rpm

Mandriva Business Server 2/X86_64:
d119276a0b0f79ea80ce07c3a4fbdd61 mbs2/x86_64/apache-mod_dav_svn-1.8.13-1.mbs2.x86_64.rpm
9b95df70751f4cd576df2c821bb8a252 mbs2/x86_64/lib64svn0-1.8.13-1.mbs2.x86_64.rpm
97ad4790a185fe6be5f03a70b87ba6eb mbs2/x86_64/lib64svnjavahl1-1.8.13-1.mbs2.x86_64.rpm
3c877e6474855c2f7d356136feed637d mbs2/x86_64/perl-SVN-1.8.13-1.mbs2.x86_64.rpm
3a7acd54b71f1b879a0df49918c52dac mbs2/x86_64/perl-svn-devel-1.8.13-1.mbs2.x86_64.rpm
85fb6b75c0e7353fa12ca07aae7ef0ec mbs2/x86_64/python-svn-1.8.13-1.mbs2.x86_64.rpm
4f49f899bd6c44fa463a5de888dc0d1f mbs2/x86_64/python-svn-devel-1.8.13-1.mbs2.x86_64.rpm
bf8bc3693c401dc104f7d70485c85592 mbs2/x86_64/ruby-svn-1.8.13-1.mbs2.x86_64.rpm
d777cc96f096a284252f037714c59e21 mbs2/x86_64/ruby-svn-devel-1.8.13-1.mbs2.x86_64.rpm
84a949f8d941f9be6f5ad893fa2d07c9 mbs2/x86_64/subversion-1.8.13-1.mbs2.x86_64.rpm
ff2ca998dcb48d1ebb6fd90bf54bdd41 mbs2/x86_64/subversion-devel-1.8.13-1.mbs2.x86_64.rpm
1bac588bd8d69888390ac58c0482e069 mbs2/x86_64/subversion-doc-1.8.13-1.mbs2.x86_64.rpm
2567c1dca210921e8c91702298c6b55e mbs2/x86_64/subversion-server-1.8.13-1.mbs2.x86_64.rpm
64eda374400f18c1ea39e9a6c7c8de86 mbs2/x86_64/subversion-tools-1.8.13-1.mbs2.x86_64.rpm
6c7f82ee4ddf71bb8d00c9e480b53954 mbs2/x86_64/svn-javahl-1.8.13-1.mbs2.x86_64.rpm
792c55ba6ff05a62eba107cecf81ab1f mbs2/SRPMS/subversion-1.8.13-1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVHi4DmqjQ0CJFipgRAq4PAJ4rT78F0pjFUsLAj5g2LyW/i7FzjACghsR2
8qy1ijw1LXYodmRPbqqvZOY=
=Y/G0
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close