| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 03 Apr 2015 09:07:00 +0200 From: security@...driva.com To: bugtraq@...urityfocus.com Subject: [ MDVSA-2015:192 ] subversion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2015:192 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : subversion Date : April 3, 2015 Affected: Business Server 1.0, Business Server 2.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in subversion: Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests (CVE-2015-0202). Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers (CVE-2015-0248). Subversion HTTP servers allow spoofing svn:author property values for new revisions (CVE-2015-0251). The updated packages have been upgraded to the 1.7.20 and 1.8.13 versions where these security flaws has been fixed. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251 http://subversion.apache.org/security/CVE-2015-0202-advisory.txt http://subversion.apache.org/security/CVE-2015-0248-advisory.txt http://subversion.apache.org/security/CVE-2015-0251-advisory.txt _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 431997d6c51445e6dfd80aa257d71cde mbs1/x86_64/apache-mod_dav_svn-1.7.20-1.mbs1.x86_64.rpm be7ff8ab86b7d249c90e681ff94d7e5c mbs1/x86_64/lib64svn0-1.7.20-1.mbs1.x86_64.rpm 666178703664d199455b8a67e1f2e8d7 mbs1/x86_64/lib64svn-gnome-keyring0-1.7.20-1.mbs1.x86_64.rpm 3ce5845f3f36d40f4b61803ab22baad0 mbs1/x86_64/lib64svnjavahl1-1.7.20-1.mbs1.x86_64.rpm adaf02401908f768d1a5ed1fae2a2845 mbs1/x86_64/perl-SVN-1.7.20-1.mbs1.x86_64.rpm 02c85a550542afc0ab22c05ccfe0a569 mbs1/x86_64/perl-svn-devel-1.7.20-1.mbs1.x86_64.rpm a6b4145e35dcf218b2aaf9dfec09a071 mbs1/x86_64/python-svn-1.7.20-1.mbs1.x86_64.rpm 9efccfc610ce975e3fa056d0a96479ac mbs1/x86_64/python-svn-devel-1.7.20-1.mbs1.x86_64.rpm 5a7f2f8e3f82896a0336904b448b8e09 mbs1/x86_64/ruby-svn-1.7.20-1.mbs1.x86_64.rpm 99001923a24600d2e5f9d41a852d226a mbs1/x86_64/ruby-svn-devel-1.7.20-1.mbs1.x86_64.rpm 6ff89286c065648f4004941dcad80b7c mbs1/x86_64/subversion-1.7.20-1.mbs1.x86_64.rpm 7378f77b345dbdcb007ca85507fdf7f5 mbs1/x86_64/subversion-devel-1.7.20-1.mbs1.x86_64.rpm d1c035d3757ab042971d47c8d8c1a936 mbs1/x86_64/subversion-doc-1.7.20-1.mbs1.x86_64.rpm 0dae2994b65b1795239d1d755e1ad853 mbs1/x86_64/subversion-gnome-keyring-devel-1.7.20-1.mbs1.x86_64.rpm 8a52bff9e69570d1444e289922712885 mbs1/x86_64/subversion-server-1.7.20-1.mbs1.x86_64.rpm a13c7bc82cca7e21f3f709070c649fdd mbs1/x86_64/subversion-tools-1.7.20-1.mbs1.x86_64.rpm ee3d0af44b559c0fcdc39899ed468722 mbs1/x86_64/svn-javahl-1.7.20-1.mbs1.x86_64.rpm d35a59dacee19678345bca7f62a9dc43 mbs1/SRPMS/subversion-1.7.20-1.mbs1.src.rpm Mandriva Business Server 2/X86_64: d119276a0b0f79ea80ce07c3a4fbdd61 mbs2/x86_64/apache-mod_dav_svn-1.8.13-1.mbs2.x86_64.rpm 9b95df70751f4cd576df2c821bb8a252 mbs2/x86_64/lib64svn0-1.8.13-1.mbs2.x86_64.rpm 97ad4790a185fe6be5f03a70b87ba6eb mbs2/x86_64/lib64svnjavahl1-1.8.13-1.mbs2.x86_64.rpm 3c877e6474855c2f7d356136feed637d mbs2/x86_64/perl-SVN-1.8.13-1.mbs2.x86_64.rpm 3a7acd54b71f1b879a0df49918c52dac mbs2/x86_64/perl-svn-devel-1.8.13-1.mbs2.x86_64.rpm 85fb6b75c0e7353fa12ca07aae7ef0ec mbs2/x86_64/python-svn-1.8.13-1.mbs2.x86_64.rpm 4f49f899bd6c44fa463a5de888dc0d1f mbs2/x86_64/python-svn-devel-1.8.13-1.mbs2.x86_64.rpm bf8bc3693c401dc104f7d70485c85592 mbs2/x86_64/ruby-svn-1.8.13-1.mbs2.x86_64.rpm d777cc96f096a284252f037714c59e21 mbs2/x86_64/ruby-svn-devel-1.8.13-1.mbs2.x86_64.rpm 84a949f8d941f9be6f5ad893fa2d07c9 mbs2/x86_64/subversion-1.8.13-1.mbs2.x86_64.rpm ff2ca998dcb48d1ebb6fd90bf54bdd41 mbs2/x86_64/subversion-devel-1.8.13-1.mbs2.x86_64.rpm 1bac588bd8d69888390ac58c0482e069 mbs2/x86_64/subversion-doc-1.8.13-1.mbs2.x86_64.rpm 2567c1dca210921e8c91702298c6b55e mbs2/x86_64/subversion-server-1.8.13-1.mbs2.x86_64.rpm 64eda374400f18c1ea39e9a6c7c8de86 mbs2/x86_64/subversion-tools-1.8.13-1.mbs2.x86_64.rpm 6c7f82ee4ddf71bb8d00c9e480b53954 mbs2/x86_64/svn-javahl-1.8.13-1.mbs2.x86_64.rpm 792c55ba6ff05a62eba107cecf81ab1f mbs2/SRPMS/subversion-1.8.13-1.mbs2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFVHi4DmqjQ0CJFipgRAq4PAJ4rT78F0pjFUsLAj5g2LyW/i7FzjACghsR2 8qy1ijw1LXYodmRPbqqvZOY= =Y/G0 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists