CVE-2014-0032

Publication date 14 February 2014

Last updated 24 July 2024

Ubuntu priority

The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
subversion	14.04 LTS trusty	Not in release
	13.10 saucy	Ignored end of life
	12.10 quantal	Ignored end of life
	12.04 LTS precise	Fixed 1.6.17dfsg-3ubuntu3.4
	10.04 LTS lucid	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
subversion	Upstream: http://svn.apache.org/viewvc?view=revision&revision=r1557320 Upstream: http://svn.apache.org/viewvc?view=revision&revision=1558692

References

Related Ubuntu Security Notices (USN)

USN-2316-1
Subversion vulnerabilities
14 August 2014

CVE-2014-0032

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references