PT-2013-3429 · Apache+3 · Subversion+4

Ben Reser · Published 2013-02-05 · Updated 2024-06-15 · CVE-2013-1846

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Subversion versions 1.6.x through 1.6.21 Subversion versions 1.7.0 through 1.7.8

Description The issue allows remote authenticated users to cause a denial of service, resulting in a crash due to a NULL pointer dereference. This can be achieved through a LOCK on an activity URL.

Recommendations For Subversion versions 1.6.x through 1.6.21, update to version 1.6.21 or later to resolve the issue. For Subversion versions 1.7.0 through 1.7.8, update to version 1.7.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the mod dav svn module until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2013_0737

CVE-2013-1846

DLA-207-1

OPENSUSE-SU-2024:10538-1

RHSA-2013:0737

RHSA-2013_0737

SUSE-SU-2015:0709-1

Affected Products

Apache Subversion

Centos

Red Hat

Subversion

Suse

References · 68

• https://nvd.nist.gov/vuln/detail/CVE-2013-1846 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1846 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-1846 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:153 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00069.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1893-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0737.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1846 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1847 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0737.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1846 · Vendor Advisory