PT-2016-5044 · Apache+2 · Apache Subversion+2

Published 2016-04-29 · Updated 2024-06-15 · CVE-2016-2168

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Subversion versions prior to 1.8.16 Apache Subversion versions 1.9.x prior to 1.9.4

Description The issue allows remote authenticated users to cause a denial of service, resulting in a crash, by sending a crafted header in a MOVE or COPY request. This is due to a NULL pointer dereference in the req check access function within the mod authz svn module of the httpd server.

Recommendations For Apache Subversion versions prior to 1.8.16, update to version 1.8.16 or later. For Apache Subversion versions 1.9.x prior to 1.9.4, update to version 1.9.4 or later.

Fix

Related Identifiers

ALT-PU-2020-1641

ALT-PU-2020-2914

CVE-2016-2168

DLA-448-1

DSA-3561-1

MGASA-2016-0161

OPENSUSE-SU-2024:10538-1

SUSE-SU-2016:1249-1

SUSE-SU-2016:1511-1

SUSE-SU-2017:2200-1

USN-3388-2

Affected Products

Alt Linux

Apache Subversion

Suse

References · 112

• https://ubuntu.com/security/CVE-2016-2168 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02070 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.417496 · Vendor Advisory
• https://security.gentoo.org/glsa/201610-05 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5259 · Security Note
• https://debian.org/security/2016/dsa-3561 · Vendor Advisory
• http://subversion.apache.org/security/CVE-2016-2168-advisory.txt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8734 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• http://debian.org/security/2016/dsa-3561 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2168 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2168 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3561-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2200-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11782 · Security Note