| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1UVgQf-0000jc-5a@titan.mandriva.com> Date: Fri, 26 Apr 2013 13:03:00 +0200 From: security@...driva.com To: full-disclosure@...ts.grok.org.uk Subject: [ MDVSA-2013:152 ] subversion -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:152 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : subversion Date : April 26, 2013 Affected: Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in subversion: Subversion's mod_dav_svn Apache HTTPD server module will use excessive amounts of memory when a large number of properties are set or deleted on a node. This can lead to a DoS. There are no known instances of this problem being observed in the wild (CVE-2013-1845). Subversion's mod_dav_svn Apache HTTPD server module will crash when a LOCK request is made against activity URLs. This can lead to a DoS. There are no known instances of this problem being observed in the wild (CVE-2013-1846). Subversion's mod_dav_svn Apache HTTPD server module will crash in some circumstances when a LOCK request is made against a non-existent URL. This can lead to a DoS. There are no known instances of this problem being observed in the wild (CVE-2013-1847). Subversion's mod_dav_svn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs. This can lead to a DoS. There are no known instances of this problem being observed in the wild, but the details of how to exploit it have been disclosed on the full disclosure mailing list (CVE-2013-1849). The updated packages have been upgraded to the 1.6.21 version which is not affected by these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1846 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1847 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 http://subversion.apache.org/security/CVE-2013-1845-advisory.txt http://subversion.apache.org/security/CVE-2013-1846-advisory.txt http://subversion.apache.org/security/CVE-2013-1847-advisory.txt http://subversion.apache.org/security/CVE-2013-1849-advisory.txt _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: 01ca2eecdec867e6482b72d56d59f297 mes5/i586/apache-mod_dav_svn-1.6.21-0.1mdvmes5.2.i586.rpm f4858616ec625b76632955a3c4f0201b mes5/i586/apache-mod_dontdothat-1.6.21-0.1mdvmes5.2.i586.rpm 81375e280a20a0cae8b95f15779b50c9 mes5/i586/libsvn0-1.6.21-0.1mdvmes5.2.i586.rpm 0194663a7aa650742c21b19535da7db9 mes5/i586/libsvnjavahl1-1.6.21-0.1mdvmes5.2.i586.rpm bbd8cb1cb5016ff64d8c26bc35af98e5 mes5/i586/perl-SVN-1.6.21-0.1mdvmes5.2.i586.rpm 9068de03c3d850b5bb050bc5a582d885 mes5/i586/python-svn-1.6.21-0.1mdvmes5.2.i586.rpm bc76933bb1f1349d37b889d8d3a5d1d5 mes5/i586/ruby-svn-1.6.21-0.1mdvmes5.2.i586.rpm a3674f9bd14e13cfb684821971112ee6 mes5/i586/subversion-1.6.21-0.1mdvmes5.2.i586.rpm bfab26ea3f2d5ecd55e5350fe7a6e6c0 mes5/i586/subversion-devel-1.6.21-0.1mdvmes5.2.i586.rpm 20c206e8318bbc09cb289ced9de0812e mes5/i586/subversion-doc-1.6.21-0.1mdvmes5.2.i586.rpm 255c1ba61e91a945257640270cc1de73 mes5/i586/subversion-server-1.6.21-0.1mdvmes5.2.i586.rpm 9c6743ee825f3f9d71e98c6007c17de5 mes5/i586/subversion-tools-1.6.21-0.1mdvmes5.2.i586.rpm 4f88ebb8caf198a907a3b861e1bf8683 mes5/i586/svn-javahl-1.6.21-0.1mdvmes5.2.i586.rpm 6d6973f61a318530b78046f115ea0d64 mes5/SRPMS/subversion-1.6.21-0.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 19813fb2e9b28a368f8ba8c1637cdefb mes5/x86_64/apache-mod_dav_svn-1.6.21-0.1mdvmes5.2.x86_64.rpm 477c2bc44a5a59365d0b199b2aec30e0 mes5/x86_64/apache-mod_dontdothat-1.6.21-0.1mdvmes5.2.x86_64.rpm ff0fda86a6ca2d989b26d06a239e104e mes5/x86_64/lib64svn0-1.6.21-0.1mdvmes5.2.x86_64.rpm b0f45a52e0cb62518fd2eba747f7296f mes5/x86_64/lib64svnjavahl1-1.6.21-0.1mdvmes5.2.x86_64.rpm 73475d40bce1b1bed2d09ed384a7dadd mes5/x86_64/perl-SVN-1.6.21-0.1mdvmes5.2.x86_64.rpm 26bc46bfb6f2eb419a60cd8eb24695fb mes5/x86_64/python-svn-1.6.21-0.1mdvmes5.2.x86_64.rpm 651048764744b4813bb7028ded94b670 mes5/x86_64/ruby-svn-1.6.21-0.1mdvmes5.2.x86_64.rpm 41c4d3fc4ebb30df80cafb372d51eff1 mes5/x86_64/subversion-1.6.21-0.1mdvmes5.2.x86_64.rpm 7d33856690ade09f91de86a70702a0ba mes5/x86_64/subversion-devel-1.6.21-0.1mdvmes5.2.x86_64.rpm b1cfdbf4d1fa023640e59b709a114ad0 mes5/x86_64/subversion-doc-1.6.21-0.1mdvmes5.2.x86_64.rpm 4e35ad407cffa9cfee09dc02675d99f9 mes5/x86_64/subversion-server-1.6.21-0.1mdvmes5.2.x86_64.rpm 7723aa67d59f81fa693ba6a2e34b507a mes5/x86_64/subversion-tools-1.6.21-0.1mdvmes5.2.x86_64.rpm 85e266caa0ae80bbc8416fd8038f32b2 mes5/x86_64/svn-javahl-1.6.21-0.1mdvmes5.2.x86_64.rpm 6d6973f61a318530b78046f115ea0d64 mes5/SRPMS/subversion-1.6.21-0.1mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRejMQmqjQ0CJFipgRAklHAJ4xHOnB++FaGe2Gi/ek8aX081FePgCgmOuF qJeXPdHQ7VRFRUtSqz0y5Sg= =MHqP -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists