CVSS: 9.0EPSS: 94%CPEs: 3EXPL: 0CVE-2015-5259
https://notcve.org/view.php?id=CVE-2015-5259
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read. Desbordamiento de entero en la función read_string en libsvn_ra_svn/marshal.c en Apache Subversion 1.9.x en versiones anteriores a 1.9.3 permite a atacantes remotos ejecutar código arbitrario a través de una cadena del protocolo svn://, lo que desencadena un desbordamiento de buffer basado en memoria dinámica y una lectura fuera de rango. • http://subversion.apache.org/security/CVE-2015-5259-advisory.txt http://www.securityfocus.com/bid/82300 http://www.securitytracker.com/id/1034469 https://security.gentoo.org/glsa/201610-05 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-189: Numeric Errors •
CVSS: 8.0EPSS: 94%CPEs: 4EXPL: 0CVE-2015-5343
https://notcve.org/view.php?id=CVE-2015-5343
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow. Desbordamiento de entero en util.c en mod_dav_svn en Apache Subversion 1.7.x, 1.8.x en versiones anteriores a 1.8.15 y 1.9.x en versiones anteriores a 1.9.3 permite a usuarios remotos autenticados causar una denegación de servicio (caída de servidor subversion o consumo de memoria) y posiblemente ejecutar código arbitrario a través de un cuerpo de petición con codificado skel, lo que desencadena una lectura fuera de rango y desbordamiento de buffer basado en memoria dinámica. • http://subversion.apache.org/security/CVE-2015-5343-advisory.txt http://www.debian.org/security/2015/dsa-3424 http://www.securitytracker.com/id/1034470 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.405261 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.0EPSS: 0%CPEs: 14EXPL: 0CVE-2015-3187 – subversion: svn_repos_trace_node_locations() reveals paths hidden by authz
https://notcve.org/view.php?id=CVE-2015-3187
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Vulnerabilidad en la función svn_repos_trace_node_locations en Apache Subversion en versiones anteriores a 1.7.21 y 1.8.x en versiones anteriores a 1.8.14, cuando se utiliza autorización basada en ruta, permite a usuarios remotos autenticados obtener información de ruta sensible leyendo el historial de un nodo que ha sido movido desde una ruta oculta. It was found that when an SVN server (both svnserve and httpd with the mod_dav_svn module) searched the history of a file or a directory, it would disclose its location in the repository if that file or directory was not readable (for example, if it had been moved). • http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-1633.html http://rhn.redhat.com/errata/RHSA-2015-1742.html http://subversion.apache.org/security/CVE-2015-3187-advisory.txt http://www.debian.org/security/2015/dsa-3331 http://www.securityfocus.com/bid/76273 http://www.securitytracker.com/id/1033215 http://www.ubuntu.com/usn/USN-2721-1 https:/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 46EXPL: 0CVE-2015-3184 – subversion: Mixed anonymous/authenticated path-based authz with httpd 2.4
https://notcve.org/view.php?id=CVE-2015-3184
mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Vulnerabilidad en mod_authz_svn en Apache Subversion 1.7.x en versiones anteriores a 1.7.21 y 1.8.x en versiones anteriores a 1.8.14, al utilizar Apache httpd 2.4.x, no restringe correctamente el acceso anónimo, lo que permite a usuarios anónimos remotos leer archivos ocultos a través del nombre de la ruta. It was found that the mod_authz_svn module did not properly restrict anonymous access to Subversion repositories under certain configurations when used with Apache httpd 2.4.x. This could allow a user to anonymously access files in a Subversion repository, which should only be accessible to authenticated users. • http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html http://rhn.redhat.com/errata/RHSA-2015-1742.html http://subversion.apache.org/security/CVE-2015-3184-advisory.txt http://www.debian.org/security/2015/dsa-3331 http://www.securityfocus.com/bid/76274 http://www.securitytracker.com/id/1033215 http://www.ubuntu.com/usn/USN-2721-1 https://security.gentoo.org/glsa/201610-05 https://support • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-285: Improper Authorization •
CVSS: 4.0EPSS: 0%CPEs: 73EXPL: 0CVE-2015-0251 – subversion: (mod_dav_svn) spoofing svn:author property values for new revisions
https://notcve.org/view.php?id=CVE-2015-0251
The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. El servidor mod_dav_svn en Subversion 1.5.0 hasta 1.7.19 y 1.8.0 hasta 1.8.11 permite a usuarios remotos autenticados falsificar la propiedad svn:author a través de secuencias manipuladas de solicitudes del protocolo v1 HTTP. It was found that the mod_dav_svn module did not properly validate the svn:author property of certain requests. An attacker able to create new revisions could use this flaw to spoof the svn:author property. • http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html http://lists.opensuse.org/opensuse-updates/2015-04/msg00008.html http://rhn.redhat.com/errata/RHSA-2015-1633.html http://rhn.redhat.com/errata/RHSA-2015-1742.html http://seclists.org/fulldisclosure/2015/Jun/32 http://subversion.apache.org/security/CVE-2015-0251-advisory.txt http://www.debian.org/security/2015/dsa-3231 http://www.mandriva.com/security/advisories?name=MDVSA-2015:192 http://www.oracle.com& • CWE-345: Insufficient Verification of Data Authenticity CWE-348: Use of Less Trusted Source •