Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:1263-1

Опубликовано: 07 мая 2016
Источник: suse-cvrf

Описание

Security update for subversion

This update for subversion fixes the following issues:

  • CVE-2016-2167: mod_authz_svn: DoS in MOVE/COPY authorization check (bsc#976849)
  • CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm (bsc#976850)

The following non-security bugs were fixed:

  • bsc#969159: subversion dependencies did not enforce matching password store
  • bsc#911620: svnserve could not be started via YaST Service manager

This update was imported from the SUSE:SLE-12:Update update project.

Список пакетов

openSUSE Leap 42.1
libsvn_auth_gnome_keyring-1-0-1.8.10-9.1
libsvn_auth_kwallet-1-0-1.8.10-9.1
subversion-1.8.10-9.1
subversion-bash-completion-1.8.10-9.1
subversion-devel-1.8.10-9.1
subversion-perl-1.8.10-9.1
subversion-python-1.8.10-9.1
subversion-ruby-1.8.10-9.1
subversion-server-1.8.10-9.1
subversion-tools-1.8.10-9.1

Ссылки

Описание

The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.

Затронутые продукты
openSUSE Leap 42.1:libsvn_auth_gnome_keyring-1-0-1.8.10-9.1
openSUSE Leap 42.1:libsvn_auth_kwallet-1-0-1.8.10-9.1
openSUSE Leap 42.1:subversion-1.8.10-9.1
openSUSE Leap 42.1:subversion-bash-completion-1.8.10-9.1
Ссылки

Описание

The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.

Затронутые продукты
openSUSE Leap 42.1:libsvn_auth_gnome_keyring-1-0-1.8.10-9.1
openSUSE Leap 42.1:libsvn_auth_kwallet-1-0-1.8.10-9.1
openSUSE Leap 42.1:subversion-1.8.10-9.1
openSUSE Leap 42.1:subversion-bash-completion-1.8.10-9.1
Ссылки