| Summary: | <dev-vcs/subversion-1.7.9: Multiple DoS vulnerabilities (CVE-2013-{1845,1846,1847,1884}) | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sean Amoss (RETIRED) <ackle> | ||||
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | normal | CC: | tommy | ||||
| Priority: | Normal | ||||||
| Version: | unspecified | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| URL: | https://dist.apache.org/repos/dist/dev/subversion/?p=1654 | ||||||
| Whiteboard: | A3 [glsa] | ||||||
| Package list: | Runtime testing required: | --- | |||||
| Bug Depends on: | |||||||
| Bug Blocks: | 463728 | ||||||
| Attachments: |
|
||||||
|
Description
Sean Amoss (RETIRED)
2013-03-30 14:20:41 UTC
I dont plan to support the 1.6 series anymore, so this will result in 1.6.17-r7 being dropped, unless someone else steps up to maintain the 1.6 series or subversion itself. the fixed 1.7.9 version from $URL compiles fine with the 1.7.8 ebuild, so a quick bump for that one can be done. Now public. ebuild for 1.7.9 added (In reply to comment #3) > ebuild for 1.7.9 added Should we proceed to stabilize? (In reply to comment #4) > (In reply to comment #3) > > ebuild for 1.7.9 added > > Should we proceed to stabilize? I added 2 dependency related fixes yesterday, which also affected version 1.7.7 as the current stable version. Otherwise there have not been any bug reports, so looks good for stabilization. Arches, please test and mark stable: =dev-vcs/subversion-1.7.9 Target KEYWORDS: "alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~x86-freebsd ~hppa-hpux ~ia64-hpux ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris" amd64 stable x86 stable arm stable ia64 stable ppc stable ppc64 stable s390 stable sh stable sparc stable Stable for HPPA. alpha stable Old removed, @security, please add it to existing draft. CVE-2013-1884 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1884): The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable. CVE-2013-1847 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1847): The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. CVE-2013-1846 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1846): The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL. CVE-2013-1845 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1845): The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory. Updated existing GLSA. This issue was resolved and addressed in GLSA 201309-11 at http://security.gentoo.org/glsa/glsa-201309-11.xml by GLSA coordinator Sean Amoss (ackle). |