PT-2013-3495 · Apache+4 · Subversion+5

Stefan Sperling · Published 2013-02-19 · Updated 2024-06-15 · CVE-2013-1968

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Subversion versions prior to 1.6.23 Subversion versions 1.7.x prior to 1.7.10

Description The issue allows remote authenticated users to cause a denial of service by corrupting the FSFS repository. This is due to incorrect handling of file names, specifically when a newline character is present in a file name. The exploitation of this issue can lead to repository corruption, making it unusable.

Recommendations For Subversion versions prior to 1.6.23, update to version 1.6.23 or later to resolve the issue. For Subversion versions 1.7.x prior to 1.7.10, update to version 1.7.10 or later to resolve the issue.

Fix

Related Identifiers

ALT-PU-2015-1708

CESA-2014_0255

CVE-2013-1968

DSA-2703-1

MGASA-2013-0175

OPENSUSE-SU-2024:10538-1

RHSA-2014:0255

RHSA-2014_0255

SUSE-SU-2013_1217-1

SUSE-SU-2015:0709-1

Affected Products

Alt Linux

Apache Subversion

Centos

Red Hat

Subversion

Suse

References · 95

• https://bdu.fstec.ru/vul/2015-00404 · Security Note
• https://subversion.apache.org/security/CVE-2013-1968-advisory.txt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248 · Security Note
• http://debian.org/security/2013/dsa-2703 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1849 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-1968 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory