bugtraq - [ MDVSA-2013:152 ] subversion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1UVgQe-0000jV-UV@titan.mandriva.com>
Date: Fri, 26 Apr 2013 13:03:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2013:152 ] subversion

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2013:152
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : subversion
 Date    : April 26, 2013
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in subversion:
 
 Subversion&#039;s mod_dav_svn Apache HTTPD server module will use excessive
 amounts of memory when a large number of properties are set or deleted
 on a node. This can lead to a DoS. There are no known instances of
 this problem being observed in the wild (CVE-2013-1845).
 
 Subversion&#039;s mod_dav_svn Apache HTTPD server module will crash when
 a LOCK request is made against activity URLs. This can lead to a
 DoS. There are no known instances of this problem being observed in
 the wild (CVE-2013-1846).
 
 Subversion&#039;s mod_dav_svn Apache HTTPD server module will crash in
 some circumstances when a LOCK request is made against a non-existent
 URL. This can lead to a DoS. There are no known instances of this
 problem being observed in the wild (CVE-2013-1847).
 
 Subversion&#039;s mod_dav_svn Apache HTTPD server module will crash when
 a PROPFIND request is made against activity URLs. This can lead to a
 DoS. There are no known instances of this problem being observed in
 the wild, but the details of how to exploit it have been disclosed
 on the full disclosure mailing list (CVE-2013-1849).
 
 The updated packages have been upgraded to the 1.6.21 version which
 is not affected by these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1846
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1847
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849
 http://subversion.apache.org/security/CVE-2013-1845-advisory.txt
 http://subversion.apache.org/security/CVE-2013-1846-advisory.txt
 http://subversion.apache.org/security/CVE-2013-1847-advisory.txt
 http://subversion.apache.org/security/CVE-2013-1849-advisory.txt
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 01ca2eecdec867e6482b72d56d59f297  mes5/i586/apache-mod_dav_svn-1.6.21-0.1mdvmes5.2.i586.rpm
 f4858616ec625b76632955a3c4f0201b  mes5/i586/apache-mod_dontdothat-1.6.21-0.1mdvmes5.2.i586.rpm
 81375e280a20a0cae8b95f15779b50c9  mes5/i586/libsvn0-1.6.21-0.1mdvmes5.2.i586.rpm
 0194663a7aa650742c21b19535da7db9  mes5/i586/libsvnjavahl1-1.6.21-0.1mdvmes5.2.i586.rpm
 bbd8cb1cb5016ff64d8c26bc35af98e5  mes5/i586/perl-SVN-1.6.21-0.1mdvmes5.2.i586.rpm
 9068de03c3d850b5bb050bc5a582d885  mes5/i586/python-svn-1.6.21-0.1mdvmes5.2.i586.rpm
 bc76933bb1f1349d37b889d8d3a5d1d5  mes5/i586/ruby-svn-1.6.21-0.1mdvmes5.2.i586.rpm
 a3674f9bd14e13cfb684821971112ee6  mes5/i586/subversion-1.6.21-0.1mdvmes5.2.i586.rpm
 bfab26ea3f2d5ecd55e5350fe7a6e6c0  mes5/i586/subversion-devel-1.6.21-0.1mdvmes5.2.i586.rpm
 20c206e8318bbc09cb289ced9de0812e  mes5/i586/subversion-doc-1.6.21-0.1mdvmes5.2.i586.rpm
 255c1ba61e91a945257640270cc1de73  mes5/i586/subversion-server-1.6.21-0.1mdvmes5.2.i586.rpm
 9c6743ee825f3f9d71e98c6007c17de5  mes5/i586/subversion-tools-1.6.21-0.1mdvmes5.2.i586.rpm
 4f88ebb8caf198a907a3b861e1bf8683  mes5/i586/svn-javahl-1.6.21-0.1mdvmes5.2.i586.rpm 
 6d6973f61a318530b78046f115ea0d64  mes5/SRPMS/subversion-1.6.21-0.1mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 19813fb2e9b28a368f8ba8c1637cdefb  mes5/x86_64/apache-mod_dav_svn-1.6.21-0.1mdvmes5.2.x86_64.rpm
 477c2bc44a5a59365d0b199b2aec30e0  mes5/x86_64/apache-mod_dontdothat-1.6.21-0.1mdvmes5.2.x86_64.rpm
 ff0fda86a6ca2d989b26d06a239e104e  mes5/x86_64/lib64svn0-1.6.21-0.1mdvmes5.2.x86_64.rpm
 b0f45a52e0cb62518fd2eba747f7296f  mes5/x86_64/lib64svnjavahl1-1.6.21-0.1mdvmes5.2.x86_64.rpm
 73475d40bce1b1bed2d09ed384a7dadd  mes5/x86_64/perl-SVN-1.6.21-0.1mdvmes5.2.x86_64.rpm
 26bc46bfb6f2eb419a60cd8eb24695fb  mes5/x86_64/python-svn-1.6.21-0.1mdvmes5.2.x86_64.rpm
 651048764744b4813bb7028ded94b670  mes5/x86_64/ruby-svn-1.6.21-0.1mdvmes5.2.x86_64.rpm
 41c4d3fc4ebb30df80cafb372d51eff1  mes5/x86_64/subversion-1.6.21-0.1mdvmes5.2.x86_64.rpm
 7d33856690ade09f91de86a70702a0ba  mes5/x86_64/subversion-devel-1.6.21-0.1mdvmes5.2.x86_64.rpm
 b1cfdbf4d1fa023640e59b709a114ad0  mes5/x86_64/subversion-doc-1.6.21-0.1mdvmes5.2.x86_64.rpm
 4e35ad407cffa9cfee09dc02675d99f9  mes5/x86_64/subversion-server-1.6.21-0.1mdvmes5.2.x86_64.rpm
 7723aa67d59f81fa693ba6a2e34b507a  mes5/x86_64/subversion-tools-1.6.21-0.1mdvmes5.2.x86_64.rpm
 85e266caa0ae80bbc8416fd8038f32b2  mes5/x86_64/svn-javahl-1.6.21-0.1mdvmes5.2.x86_64.rpm 
 6d6973f61a318530b78046f115ea0d64  mes5/SRPMS/subversion-1.6.21-0.1mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRejMQmqjQ0CJFipgRAklHAJ4xHOnB++FaGe2Gi/ek8aX081FePgCgmOuF
qJeXPdHQ7VRFRUtSqz0y5Sg=
=MHqP
-----END PGP SIGNATURE-----