PT-2011-1047 · Debian · Viewvc

Ludwig Nussel · Published 2011-05-23 · Updated 2024-06-15 · CVE-2012-3357

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ViewVC versions prior to 1.1.15

Description The issue concerns multiple vulnerabilities in the ViewVC package of the Debian GNU/Linux operating system, which can be exploited remotely to compromise the confidentiality of protected information. Specifically, the SVN revision view in ViewVC does not properly handle log messages when a readable path is copied from an unreadable path, allowing remote attackers to obtain sensitive information, related to a "log msg leak."

Recommendations For versions prior to 1.1.15, update to version 1.1.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the SVN revision view functionality until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-399

CWE-200

Related Identifiers

BDU:2015-03044

CVE-2012-3357

DSA-2563-1

OPENSUSE-SU-2024:10175-1

Affected Products

Viewvc

References · 23

• http://mandriva.com/security/advisories?name=MDVSA-2013:134 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03044 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3357 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5024 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4533 · Security Note
• https://ubuntu.com/security/CVE-2012-3357 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3356 · Security Note
• https://lwn.net/Articles/505096 · Vendor Advisory
• http://debian.org/security/2012/dsa-2563 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10175-1 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3357 · Note
• https://suse.com/security/cve/CVE-2012-3357 · Note