Message-Id: <E1Ydvgy-0007yI-Ea@titan.mandriva.com>
Date: Fri, 03 Apr 2015 09:07:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:192 ] subversion

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:192
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : subversion
 Date    : April 3, 2015
 Affected: Business Server 1.0, Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in
 subversion:
 
 Subversion HTTP servers with FSFS repositories are vulnerable to a
 remotely triggerable excessive memory use with certain REPORT requests
 (CVE-2015-0202).
 
 Subversion mod_dav_svn and svnserve are vulnerable to a remotely
 triggerable assertion DoS vulnerability for certain requests with
 dynamically evaluated revision numbers (CVE-2015-0248).
 
 Subversion HTTP servers allow spoofing svn:author property values
 for new revisions (CVE-2015-0251).
 
 The updated packages have been upgraded to the 1.7.20 and 1.8.13
 versions where these security flaws has been fixed.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0202
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251
 http://subversion.apache.org/security/CVE-2015-0202-advisory.txt
 http://subversion.apache.org/security/CVE-2015-0248-advisory.txt
 http://subversion.apache.org/security/CVE-2015-0251-advisory.txt
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 431997d6c51445e6dfd80aa257d71cde  mbs1/x86_64/apache-mod_dav_svn-1.7.20-1.mbs1.x86_64.rpm
 be7ff8ab86b7d249c90e681ff94d7e5c  mbs1/x86_64/lib64svn0-1.7.20-1.mbs1.x86_64.rpm
 666178703664d199455b8a67e1f2e8d7  mbs1/x86_64/lib64svn-gnome-keyring0-1.7.20-1.mbs1.x86_64.rpm
 3ce5845f3f36d40f4b61803ab22baad0  mbs1/x86_64/lib64svnjavahl1-1.7.20-1.mbs1.x86_64.rpm
 adaf02401908f768d1a5ed1fae2a2845  mbs1/x86_64/perl-SVN-1.7.20-1.mbs1.x86_64.rpm
 02c85a550542afc0ab22c05ccfe0a569  mbs1/x86_64/perl-svn-devel-1.7.20-1.mbs1.x86_64.rpm
 a6b4145e35dcf218b2aaf9dfec09a071  mbs1/x86_64/python-svn-1.7.20-1.mbs1.x86_64.rpm
 9efccfc610ce975e3fa056d0a96479ac  mbs1/x86_64/python-svn-devel-1.7.20-1.mbs1.x86_64.rpm
 5a7f2f8e3f82896a0336904b448b8e09  mbs1/x86_64/ruby-svn-1.7.20-1.mbs1.x86_64.rpm
 99001923a24600d2e5f9d41a852d226a  mbs1/x86_64/ruby-svn-devel-1.7.20-1.mbs1.x86_64.rpm
 6ff89286c065648f4004941dcad80b7c  mbs1/x86_64/subversion-1.7.20-1.mbs1.x86_64.rpm
 7378f77b345dbdcb007ca85507fdf7f5  mbs1/x86_64/subversion-devel-1.7.20-1.mbs1.x86_64.rpm
 d1c035d3757ab042971d47c8d8c1a936  mbs1/x86_64/subversion-doc-1.7.20-1.mbs1.x86_64.rpm
 0dae2994b65b1795239d1d755e1ad853  mbs1/x86_64/subversion-gnome-keyring-devel-1.7.20-1.mbs1.x86_64.rpm
 8a52bff9e69570d1444e289922712885  mbs1/x86_64/subversion-server-1.7.20-1.mbs1.x86_64.rpm
 a13c7bc82cca7e21f3f709070c649fdd  mbs1/x86_64/subversion-tools-1.7.20-1.mbs1.x86_64.rpm
 ee3d0af44b559c0fcdc39899ed468722  mbs1/x86_64/svn-javahl-1.7.20-1.mbs1.x86_64.rpm 
 d35a59dacee19678345bca7f62a9dc43  mbs1/SRPMS/subversion-1.7.20-1.mbs1.src.rpm

 Mandriva Business Server 2/X86_64:
 d119276a0b0f79ea80ce07c3a4fbdd61  mbs2/x86_64/apache-mod_dav_svn-1.8.13-1.mbs2.x86_64.rpm
 9b95df70751f4cd576df2c821bb8a252  mbs2/x86_64/lib64svn0-1.8.13-1.mbs2.x86_64.rpm
 97ad4790a185fe6be5f03a70b87ba6eb  mbs2/x86_64/lib64svnjavahl1-1.8.13-1.mbs2.x86_64.rpm
 3c877e6474855c2f7d356136feed637d  mbs2/x86_64/perl-SVN-1.8.13-1.mbs2.x86_64.rpm
 3a7acd54b71f1b879a0df49918c52dac  mbs2/x86_64/perl-svn-devel-1.8.13-1.mbs2.x86_64.rpm
 85fb6b75c0e7353fa12ca07aae7ef0ec  mbs2/x86_64/python-svn-1.8.13-1.mbs2.x86_64.rpm
 4f49f899bd6c44fa463a5de888dc0d1f  mbs2/x86_64/python-svn-devel-1.8.13-1.mbs2.x86_64.rpm
 bf8bc3693c401dc104f7d70485c85592  mbs2/x86_64/ruby-svn-1.8.13-1.mbs2.x86_64.rpm
 d777cc96f096a284252f037714c59e21  mbs2/x86_64/ruby-svn-devel-1.8.13-1.mbs2.x86_64.rpm
 84a949f8d941f9be6f5ad893fa2d07c9  mbs2/x86_64/subversion-1.8.13-1.mbs2.x86_64.rpm
 ff2ca998dcb48d1ebb6fd90bf54bdd41  mbs2/x86_64/subversion-devel-1.8.13-1.mbs2.x86_64.rpm
 1bac588bd8d69888390ac58c0482e069  mbs2/x86_64/subversion-doc-1.8.13-1.mbs2.x86_64.rpm
 2567c1dca210921e8c91702298c6b55e  mbs2/x86_64/subversion-server-1.8.13-1.mbs2.x86_64.rpm
 64eda374400f18c1ea39e9a6c7c8de86  mbs2/x86_64/subversion-tools-1.8.13-1.mbs2.x86_64.rpm
 6c7f82ee4ddf71bb8d00c9e480b53954  mbs2/x86_64/svn-javahl-1.8.13-1.mbs2.x86_64.rpm 
 792c55ba6ff05a62eba107cecf81ab1f  mbs2/SRPMS/subversion-1.8.13-1.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVHi4DmqjQ0CJFipgRAq4PAJ4rT78F0pjFUsLAj5g2LyW/i7FzjACghsR2
8qy1ijw1LXYodmRPbqqvZOY=
=Y/G0
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists