Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2015:2363-1

Опубликовано: 25 дек. 2015
Источник: suse-cvrf

Описание

Security update for subversion

This update fixes the following security issues:

  • CVE-2015-5343: Possible remotely triggerable heap overflow and out-of-bounds read in mod_dav_svn caused by integer overflow when parsing skel-encoded request bodies. (bsc#958300)
  • CVE-2015-3184: mod_authz_svn information leak information in mixed anonymous/authenticated httpd (dav) configurations (bsc#939514)
  • CVE-2015-3187: hidden paths leaked by path-based authz (bsc#939517)

Список пакетов

openSUSE Leap 42.1
libsvn_auth_gnome_keyring-1-0-1.8.10-6.1
libsvn_auth_kwallet-1-0-1.8.10-6.1
subversion-1.8.10-6.1
subversion-bash-completion-1.8.10-6.1
subversion-devel-1.8.10-6.1
subversion-perl-1.8.10-6.1
subversion-python-1.8.10-6.1
subversion-ruby-1.8.10-6.1
subversion-server-1.8.10-6.1
subversion-tools-1.8.10-6.1

Ссылки

Описание

mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.

Затронутые продукты
openSUSE Leap 42.1:libsvn_auth_gnome_keyring-1-0-1.8.10-6.1
openSUSE Leap 42.1:libsvn_auth_kwallet-1-0-1.8.10-6.1
openSUSE Leap 42.1:subversion-1.8.10-6.1
openSUSE Leap 42.1:subversion-bash-completion-1.8.10-6.1
Ссылки

Описание

The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.

Затронутые продукты
openSUSE Leap 42.1:libsvn_auth_gnome_keyring-1-0-1.8.10-6.1
openSUSE Leap 42.1:libsvn_auth_kwallet-1-0-1.8.10-6.1
openSUSE Leap 42.1:subversion-1.8.10-6.1
openSUSE Leap 42.1:subversion-bash-completion-1.8.10-6.1
Ссылки

Описание

Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.

Затронутые продукты
openSUSE Leap 42.1:libsvn_auth_gnome_keyring-1-0-1.8.10-6.1
openSUSE Leap 42.1:libsvn_auth_kwallet-1-0-1.8.10-6.1
openSUSE Leap 42.1:subversion-1.8.10-6.1
openSUSE Leap 42.1:subversion-bash-completion-1.8.10-6.1
Ссылки