PT-2016-5044 · Apache+2 · Apache Subversion+2

Publicado 2016-04-29 · Atualizado 2024-06-15 · CVE-2016-2168

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.8.16 Apache Subversion versions 1.9.x prior to 1.9.4

Description The issue allows remote authenticated users to cause a denial of service, resulting in a crash, by sending a crafted header in a MOVE or COPY request. This is due to a NULL pointer dereference in the req check access function within the mod authz svn module of the httpd server.

Recommendations For Apache Subversion versions prior to 1.8.16, update to version 1.8.16 or later. For Apache Subversion versions 1.9.x prior to 1.9.4, update to version 1.9.4 or later.

Correção

Identificadores relacionados

ALT-PU-2020-1641

ALT-PU-2020-2914

CVE-2016-2168

DLA-448-1

DSA-3561-1

MGASA-2016-0161

OPENSUSE-SU-2024:10538-1

SUSE-SU-2016:1249-1

SUSE-SU-2016:1511-1

SUSE-SU-2017:2200-1

USN-3388-2

Produtos afetados

Alt Linux

Apache Subversion

Suse

Referências · 112

• http://mail-archives.apache.org/mod_mbox/subversion-announce/201604.mbox/%3CCAP_GPNgJet+7_MAhomFVOXPgLtewcUw9w=[e-mail]%3E · Nota
• https://ubuntu.com/security/CVE-2016-2168 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02070 · Nota de Segurança
• http://slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.417496 · Aviso do Fabricante
• https://bugzilla.suse.com/923795 · Nota
• https://security.gentoo.org/glsa/201610-05 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-0248 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2168 · Nota
• https://bugzilla.suse.com/923793 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5259 · Nota de Segurança
• https://debian.org/security/2016/dsa-3561 · Aviso do Fabricante
• http://securitytracker.com/id/1035707 · Nota
• https://suse.com/security/cve/CVE-2013-1849 · Nota
• http://subversion.apache.org/security/CVE-2016-2168-advisory.txt · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8734 · Nota de Segurança