var-201106-0131
Vulnerability from variot
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011. Apache Subversion is prone to multiple vulnerabilities, including two denial-of-service issues and an information-disclosure issue. Attackers can exploit these issues to crash the application, exhaust all memory resources, or obtain potentially sensitive information. Versions prior to Subversion 1.6.17 are vulnerable.
The mod_dav_svn Apache HTTPD server module may in certain cenarios enter a logic loop which does not exit and which allocates emory in each iteration, ultimately exhausting all the available emory on the server which can lead to a DoS (Denial Of Service) (CVE-2011-1783).
The mod_dav_svn Apache HTTPD server module may leak to remote users the file contents of files configured to be unreadable by those users (CVE-2011-1921).
Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been upgraded to the 1.6.17 version which is not vulnerable to these issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1752 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1783 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1921 http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES
Updated Packages:
Mandriva Linux 2009.0: b7dcf908858e788c0321e13109163494 2009.0/i586/apache-mod_dav_svn-1.6.17-0.1mdv2009.0.i586.rpm c403bbd6aedcd9426dc5cf72ef56d1a9 2009.0/i586/apache-mod_dontdothat-1.6.17-0.1mdv2009.0.i586.rpm 2f3d2373aed96710023c6a84819731f6 2009.0/i586/libsvn0-1.6.17-0.1mdv2009.0.i586.rpm 2b4a273ce742b44b5a18bfaba5b9e6af 2009.0/i586/libsvnjavahl1-1.6.17-0.1mdv2009.0.i586.rpm e11fb3f919ab6358d3a3ac26d803715f 2009.0/i586/perl-SVN-1.6.17-0.1mdv2009.0.i586.rpm 745a88c6044f3cf2fda88bfc80500c1a 2009.0/i586/python-svn-1.6.17-0.1mdv2009.0.i586.rpm 7baab70f65cac6de36cede330f032cc5 2009.0/i586/ruby-svn-1.6.17-0.1mdv2009.0.i586.rpm c15bd5f296328d65f2612a61238b0f01 2009.0/i586/subversion-1.6.17-0.1mdv2009.0.i586.rpm b6c69f4a93490250bc4c1c29a51d0301 2009.0/i586/subversion-devel-1.6.17-0.1mdv2009.0.i586.rpm 6b780c034fcf7caa146ac495f74776fd 2009.0/i586/subversion-doc-1.6.17-0.1mdv2009.0.i586.rpm 51e8efe6c17057098eec1e9b0d9b305e 2009.0/i586/subversion-server-1.6.17-0.1mdv2009.0.i586.rpm f974ca62b90d4db1f3eeb0dc80a06787 2009.0/i586/subversion-tools-1.6.17-0.1mdv2009.0.i586.rpm 804da077e30821641755625cb9f6f545 2009.0/i586/svn-javahl-1.6.17-0.1mdv2009.0.i586.rpm 9ac126adb88c745c67e55630c98f1dff 2009.0/SRPMS/subversion-1.6.17-0.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64: adf776406f42c9bb4c5928f8d16ad74f 2009.0/x86_64/apache-mod_dav_svn-1.6.17-0.1mdv2009.0.x86_64.rpm f35384b836889e04b9d732045deacccb 2009.0/x86_64/apache-mod_dontdothat-1.6.17-0.1mdv2009.0.x86_64.rpm cff7dcefaf6e8c3d0a7642a36661e803 2009.0/x86_64/lib64svn0-1.6.17-0.1mdv2009.0.x86_64.rpm 01019c76de0636f512bc1338a180ab1b 2009.0/x86_64/lib64svnjavahl1-1.6.17-0.1mdv2009.0.x86_64.rpm 74812d1b64db5301b1ed74db46dc08b6 2009.0/x86_64/perl-SVN-1.6.17-0.1mdv2009.0.x86_64.rpm 59e84aa6043fae46047327ac124771e9 2009.0/x86_64/python-svn-1.6.17-0.1mdv2009.0.x86_64.rpm 15fae543266ede69fa220419ca91bc8f 2009.0/x86_64/ruby-svn-1.6.17-0.1mdv2009.0.x86_64.rpm cd9be5e2b3ba9497e7f8e42a8d0181e0 2009.0/x86_64/subversion-1.6.17-0.1mdv2009.0.x86_64.rpm 8e14979cf0ac190035fcb0ae994fe4d8 2009.0/x86_64/subversion-devel-1.6.17-0.1mdv2009.0.x86_64.rpm 4c2e1922b12202697983b567638c9b92 2009.0/x86_64/subversion-doc-1.6.17-0.1mdv2009.0.x86_64.rpm a7e5997dc660568bafed59a7bab37578 2009.0/x86_64/subversion-server-1.6.17-0.1mdv2009.0.x86_64.rpm 936dc2d30cc5bb8f54b32d862af63f3d 2009.0/x86_64/subversion-tools-1.6.17-0.1mdv2009.0.x86_64.rpm e40d82e0b13a180d2a3c2ed2cd356e52 2009.0/x86_64/svn-javahl-1.6.17-0.1mdv2009.0.x86_64.rpm 9ac126adb88c745c67e55630c98f1dff 2009.0/SRPMS/subversion-1.6.17-0.1mdv2009.0.src.rpm
Mandriva Linux 2010.1: 809c8316c0cf26a1aa7a26260ebd556b 2010.1/i586/apache-mod_dav_svn-1.6.17-0.1mdv2010.2.i586.rpm 1c5aa3316d62eb40cbda3e91b5a0dead 2010.1/i586/apache-mod_dontdothat-1.6.17-0.1mdv2010.2.i586.rpm 680745e35e66433826514dc65f748597 2010.1/i586/libsvn0-1.6.17-0.1mdv2010.2.i586.rpm 2e523e3262c4fa0d918f6667c8c00bf1 2010.1/i586/libsvn-gnome-keyring0-1.6.17-0.1mdv2010.2.i586.rpm 5b8802e18a6e594676823ec01348143b 2010.1/i586/libsvnjavahl1-1.6.17-0.1mdv2010.2.i586.rpm 2d9d773efd8a108b59dd774d6030681e 2010.1/i586/libsvn-kwallet0-1.6.17-0.1mdv2010.2.i586.rpm 786cd1f13ee58d23e8246b37991f3a4c 2010.1/i586/perl-SVN-1.6.17-0.1mdv2010.2.i586.rpm f718ab77c2b5c77e2b49b38604f4663f 2010.1/i586/python-svn-1.6.17-0.1mdv2010.2.i586.rpm e006b5cef023e652caf2281a197e848a 2010.1/i586/ruby-svn-1.6.17-0.1mdv2010.2.i586.rpm a7f25d127ad47dde81e72f947a425311 2010.1/i586/subversion-1.6.17-0.1mdv2010.2.i586.rpm 2e8997143a4e9caccd531496b3d01acc 2010.1/i586/subversion-devel-1.6.17-0.1mdv2010.2.i586.rpm 1102fa83a4d71bb78410fcf52e240a6a 2010.1/i586/subversion-doc-1.6.17-0.1mdv2010.2.i586.rpm f7d57f0fb38326ef4a94f17ece68071e 2010.1/i586/subversion-server-1.6.17-0.1mdv2010.2.i586.rpm 371566535452839fd3f56d0fd1949083 2010.1/i586/subversion-tools-1.6.17-0.1mdv2010.2.i586.rpm 1625168460442b3044986aec02642ceb 2010.1/i586/svn-javahl-1.6.17-0.1mdv2010.2.i586.rpm 3186570aa3e04f22d98a28e75a394710 2010.1/SRPMS/subversion-1.6.17-0.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64: 5e499d3c40941455d1b37dbf5773991e 2010.1/x86_64/apache-mod_dav_svn-1.6.17-0.1mdv2010.2.x86_64.rpm 0aa267a7b319e2a30960ee2a5414d80e 2010.1/x86_64/apache-mod_dontdothat-1.6.17-0.1mdv2010.2.x86_64.rpm 35cdd975fcec1b990d51bdb9f1714bf4 2010.1/x86_64/lib64svn0-1.6.17-0.1mdv2010.2.x86_64.rpm 4278a8f843fb04cd2850eaa64cb0f568 2010.1/x86_64/lib64svn-gnome-keyring0-1.6.17-0.1mdv2010.2.x86_64.rpm d2c973cce463ac11b543c93e70c8aed9 2010.1/x86_64/lib64svnjavahl1-1.6.17-0.1mdv2010.2.x86_64.rpm 80302dffc3708392c44c71e8beb5318c 2010.1/x86_64/lib64svn-kwallet0-1.6.17-0.1mdv2010.2.x86_64.rpm 326ef2d296d29e081afb3191af5212ef 2010.1/x86_64/perl-SVN-1.6.17-0.1mdv2010.2.x86_64.rpm 3ebaa0c7e51c6607cbb15d032793126c 2010.1/x86_64/python-svn-1.6.17-0.1mdv2010.2.x86_64.rpm 7fac98a4b1457fdd628c0f9ac342497a 2010.1/x86_64/ruby-svn-1.6.17-0.1mdv2010.2.x86_64.rpm 5291fcc25554166520cab2642fbdf166 2010.1/x86_64/subversion-1.6.17-0.1mdv2010.2.x86_64.rpm 8b18da0f0e6e8a39f56774395c73eb21 2010.1/x86_64/subversion-devel-1.6.17-0.1mdv2010.2.x86_64.rpm 5e645e03996129bb649ca39a24a09496 2010.1/x86_64/subversion-doc-1.6.17-0.1mdv2010.2.x86_64.rpm ceb52200e4ebfeadec2d48c2c7b5fd4d 2010.1/x86_64/subversion-server-1.6.17-0.1mdv2010.2.x86_64.rpm 95aff7b1b38a5a26a58b44e3984d3d89 2010.1/x86_64/subversion-tools-1.6.17-0.1mdv2010.2.x86_64.rpm 968576b20dd363a6899c4c7eefe8b614 2010.1/x86_64/svn-javahl-1.6.17-0.1mdv2010.2.x86_64.rpm 3186570aa3e04f22d98a28e75a394710 2010.1/SRPMS/subversion-1.6.17-0.1mdv2010.2.src.rpm
Corporate 4.0: b424fc4dea5b090cc831a9b26996bb72 corporate/4.0/i586/apache-mod_dav_svn-1.6.17-0.1.20060mlcs4.i586.rpm 66fd3f68ab4e67043c7bb06bf0f5aaeb corporate/4.0/i586/apache-mod_dontdothat-1.6.17-0.1.20060mlcs4.i586.rpm cc441dda9a371692b8412af0c0b994b8 corporate/4.0/i586/libsvn0-1.6.17-0.1.20060mlcs4.i586.rpm f6005206e732c2f8484e6d49e4b26145 corporate/4.0/i586/perl-SVN-1.6.17-0.1.20060mlcs4.i586.rpm ed2db70bc8a07fe65980e4ca57abb682 corporate/4.0/i586/python-svn-1.6.17-0.1.20060mlcs4.i586.rpm ea7940a13e22f15181076d9fda196b3c corporate/4.0/i586/subversion-1.6.17-0.1.20060mlcs4.i586.rpm 93a99bf395142992eb853fde5ea11df0 corporate/4.0/i586/subversion-devel-1.6.17-0.1.20060mlcs4.i586.rpm 9498abb347b8bda55c0d16eb24b632d8 corporate/4.0/i586/subversion-doc-1.6.17-0.1.20060mlcs4.i586.rpm 0417594b6d75639b515d6154494bd982 corporate/4.0/i586/subversion-server-1.6.17-0.1.20060mlcs4.i586.rpm 9e8f089fbf491f5461b4cd3adf352105 corporate/4.0/i586/subversion-tools-1.6.17-0.1.20060mlcs4.i586.rpm 229c77a2d2172dbb17cc496d169e8dec corporate/4.0/SRPMS/subversion-1.6.17-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64: e992b482857ea06a007d88357fb5000b corporate/4.0/x86_64/apache-mod_dav_svn-1.6.17-0.1.20060mlcs4.x86_64.rpm 60c10a01326c435570ff1c009de7e545 corporate/4.0/x86_64/apache-mod_dontdothat-1.6.17-0.1.20060mlcs4.x86_64.rpm 3c9826dc51d1a6b6289a8c123edb4803 corporate/4.0/x86_64/lib64svn0-1.6.17-0.1.20060mlcs4.x86_64.rpm 061c8703b664f7243d57c36f560c037c corporate/4.0/x86_64/perl-SVN-1.6.17-0.1.20060mlcs4.x86_64.rpm ba61070e3084b50f3d3196911ee9004b corporate/4.0/x86_64/python-svn-1.6.17-0.1.20060mlcs4.x86_64.rpm e87e651ac237c9425e1a2650f9761fe9 corporate/4.0/x86_64/subversion-1.6.17-0.1.20060mlcs4.x86_64.rpm feb1ad3849b68b49b38e124db0b0d633 corporate/4.0/x86_64/subversion-devel-1.6.17-0.1.20060mlcs4.x86_64.rpm a0ed185c8c0aa4e4b0186f8aa08dc6b4 corporate/4.0/x86_64/subversion-doc-1.6.17-0.1.20060mlcs4.x86_64.rpm 0d9bdee90a50428480922d2e882f6fe3 corporate/4.0/x86_64/subversion-server-1.6.17-0.1.20060mlcs4.x86_64.rpm e5afc579bb3fbc44509241e010549e53 corporate/4.0/x86_64/subversion-tools-1.6.17-0.1.20060mlcs4.x86_64.rpm 229c77a2d2172dbb17cc496d169e8dec corporate/4.0/SRPMS/subversion-1.6.17-0.1.20060mlcs4.src.rpm
Mandriva Enterprise Server 5: d8165cb83dada65ebc80808c55c99f5d mes5/i586/apache-mod_dav_svn-1.6.17-0.1mdvmes5.2.i586.rpm 5e653275497d01bab284741d509fcc20 mes5/i586/apache-mod_dontdothat-1.6.17-0.1mdvmes5.2.i586.rpm 93ce20f3fc00bf2b0d2136b7c35538ed mes5/i586/libsvn0-1.6.17-0.1mdvmes5.2.i586.rpm c8602d9ca59963d8f288d7c1ea718cb3 mes5/i586/libsvnjavahl1-1.6.17-0.1mdvmes5.2.i586.rpm f148fab1eedbcf9a9f19d3e60c6cfadf mes5/i586/perl-SVN-1.6.17-0.1mdvmes5.2.i586.rpm d631ac32c1563680d7c5cc9bcbfcfb6b mes5/i586/python-svn-1.6.17-0.1mdvmes5.2.i586.rpm 06f830bce3b8e01f2fd40b5c637ab986 mes5/i586/ruby-svn-1.6.17-0.1mdvmes5.2.i586.rpm 357ceb371acfcd3eb9cd88caa107a53b mes5/i586/subversion-1.6.17-0.1mdvmes5.2.i586.rpm b3aa7097cb52e07a775653d822aa7dba mes5/i586/subversion-devel-1.6.17-0.1mdvmes5.2.i586.rpm 798e56237c5ea86ad3f78dc28efe5872 mes5/i586/subversion-doc-1.6.17-0.1mdvmes5.2.i586.rpm 973d3c726f9d0c502acfeacad69ac614 mes5/i586/subversion-server-1.6.17-0.1mdvmes5.2.i586.rpm 46f2b4d4539d7da8848a182a9b28afbd mes5/i586/subversion-tools-1.6.17-0.1mdvmes5.2.i586.rpm 56254352fdc6c10f56e03b8a50089105 mes5/i586/svn-javahl-1.6.17-0.1mdvmes5.2.i586.rpm c036e0758d2b25ecaf2b2773306dc9f1 mes5/SRPMS/subversion-1.6.17-0.1mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64: e41d3cd15e340df2903d1ae5fcaa958e mes5/x86_64/apache-mod_dav_svn-1.6.17-0.1mdvmes5.2.x86_64.rpm d84d598685b49e33b29b99e73bd25e61 mes5/x86_64/apache-mod_dontdothat-1.6.17-0.1mdvmes5.2.x86_64.rpm 67cc1d9ac7ac69fa494bb3c0c3ab1b24 mes5/x86_64/lib64svn0-1.6.17-0.1mdvmes5.2.x86_64.rpm 0c93407253c6456cf47ac40fdf903ae0 mes5/x86_64/lib64svnjavahl1-1.6.17-0.1mdvmes5.2.x86_64.rpm 9662f86183093a782ff143ff1c3f61a8 mes5/x86_64/perl-SVN-1.6.17-0.1mdvmes5.2.x86_64.rpm 74879ef216a0286b463c8713e1045b43 mes5/x86_64/python-svn-1.6.17-0.1mdvmes5.2.x86_64.rpm 032060ecadfbfaff5c94a2df6b7b1157 mes5/x86_64/ruby-svn-1.6.17-0.1mdvmes5.2.x86_64.rpm 4ca2ddde563edde87e5864e419db655b mes5/x86_64/subversion-1.6.17-0.1mdvmes5.2.x86_64.rpm a7690a8ee3c367539958d740bd885252 mes5/x86_64/subversion-devel-1.6.17-0.1mdvmes5.2.x86_64.rpm 6b1d4297f49e1703a69e5c73ee380686 mes5/x86_64/subversion-doc-1.6.17-0.1mdvmes5.2.x86_64.rpm 316dc293f1c4871b9833ecffc7e809b0 mes5/x86_64/subversion-server-1.6.17-0.1mdvmes5.2.x86_64.rpm d644829032a7bf93945ef6376cf1ed9c mes5/x86_64/subversion-tools-1.6.17-0.1mdvmes5.2.x86_64.rpm b25e044ca25e3891dfd4699b94bc10e2 mes5/x86_64/svn-javahl-1.6.17-0.1mdvmes5.2.x86_64.rpm c036e0758d2b25ecaf2b2773306dc9f1 mes5/SRPMS/subversion-1.6.17-0.1mdvmes5.2.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
iD8DBQFN6cg2mqjQ0CJFipgRAqj2AKCRyKt813e0OmWSTU5bL58KCmUwowCfT6RY DDOtowgSctAg4EX+tLXIvRQ= =zsmM -----END PGP SIGNATURE-----
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
APPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001
OS X Lion v10.7.3 and Security Update 2012-001 is now available and addresses the following:
Address Book Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: An attacker in a privileged network position may intercept CardDAV data Description: Address Book supports Secure Sockets Layer (SSL) for accessing CardDAV. A downgrade issue caused Address Book to attempt an unencrypted connection if an encrypted connection failed. An attacker in a privileged network position could abuse this behavior to intercept CardDAV data. This issue is addressed by not downgrading to an unencrypted connection without user approval. CVE-ID CVE-2011-3444 : Bernard Desruisseaux of Oracle Corporation
Apache Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Multiple vulnerabilities in Apache Description: Apache is updated to version 2.2.21 to address several vulnerabilities, the most serious of which may lead to a denial of service. Further information is available via the Apache web site at http://httpd.apache.org/ CVE-ID CVE-2011-3348
Apache Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. Apache disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by providing a configuration parameter to control the countermeasure and enabling it by default. CVE-ID CVE-2011-3389
CFNetwork Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Visiting a maliciously crafted website may lead to the disclosure of sensitive information Description: An issue existed in CFNetwork's handling of malformed URLs. When accessing a maliciously crafted URL, CFNetwork could send the request to an incorrect origin server. This issue does not affect systems prior to OS X Lion. CVE-ID CVE-2011-3246 : Erling Ellingsen of Facebook
CFNetwork Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Visiting a maliciously crafted website may lead to the disclosure of sensitive information Description: An issue existed in CFNetwork's handling of malformed URLs. When accessing a maliciously crafted URL, CFNetwork could send unexpected request headers. This issue does not affect systems prior to OS X Lion. CVE-ID CVE-2011-3447 : Erling Ellingsen of Facebook
ColorSync Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. This issue does not affect OS X Lion systems. CVE-ID CVE-2011-0200 : binaryproof working with TippingPoint's Zero Day Initiative
CoreAudio Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Playing maliciously crafted audio content may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of AAC encoded audio streams. This issue does not affect OS X Lion systems. CVE-ID CVE-2011-3252 : Luigi Auriemma working with TippingPoint's Zero Day Initiative
CoreMedia Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow existed in CoreMedia's handling of H.264 encoded movie files. CVE-ID CVE-2011-3448 : Scott Stender of iSEC Partners
CoreText Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing or downloading a document containing a maliciously crafted embedded font may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in the handling of font files. CVE-ID CVE-2011-3449 : Will Dormann of the CERT/CC
CoreUI Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Visiting a malicious website may lead to an unexpected application termination or arbitrary code execution Description: An unbounded stack allocation issue existed in the handling of long URLs. This issue does not affect systems prior to OS X Lion. CVE-ID CVE-2011-3450 : Ben Syverson
curl Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: A remote server may be able to impersonate clients via GSSAPI requests Description: When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This issue is addressed by disabling GSSAPI credential delegation. CVE-ID CVE-2011-2192
Data Security Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: Two certificate authorities in the list of trusted root certificates have independently issued intermediate certificates to DigiCert Malaysia. DigiCert Malaysia has issued certificates with weak keys that it is unable to revoke. An attacker with a privileged network position could intercept user credentials or other sensitive information intended for a site with a certificate issued by DigiCert Malaysia. This issue is addressed by configuring default system trust settings so that DigiCert Malaysia's certificates are not trusted. We would like to acknowledge Bruce Morton of Entrust, Inc. for reporting this issue.
dovecot Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. Dovecot disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling the countermeasure. CVE-ID CVE-2011-3389 : Apple
filecmds Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Decompressing a maliciously crafted compressed file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the 'uncompress' command line tool. CVE-ID CVE-2011-2895
ImageIO Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in ImageIO's handling of CCITT Group 4 encoded TIFF files. This issue does not affect OS X Lion systems. CVE-ID CVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies
ImageIO Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of ThunderScan encoded TIFF images. This issue is address by updating libtiff to version 3.9.5. CVE-ID CVE-2011-1167
ImageIO Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Multiple vulnerabilities in libpng 1.5.4 Description: libpng is updated to version 1.5.5 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the libpng website at http://www.libpng.org/pub/png/libpng.html CVE-ID CVE-2011-3328
Internet Sharing Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: A Wi-Fi network created by Internet Sharing may lose security settings after a system update Description: After updating to a version of OS X Lion prior to 10.7.3, the Wi-Fi configuration used by Internet Sharing may revert to factory defaults, which disables the WEP password. This issue only affects systems with Internet Sharing enabled and sharing the connection to Wi-Fi. This issue is addressed by preserving the Wi-Fi configuration during a system update. CVE-ID CVE-2011-3452 : an anonymous researcher
Libinfo Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Visiting a maliciously crafted website may lead to the disclosure of sensitive information Description: An issue existed in Libinfo's handling of hostname lookup requests. Libinfo could return incorrect results for a maliciously crafted hostname. This issue does not affect systems prior to OS X Lion. CVE-ID CVE-2011-3441 : Erling Ellingsen of Facebook
libresolv Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Applications that use OS X's libresolv library may be vulnerable to an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the parsing of DNS resource records, which may lead to heap memory corruption. CVE-ID CVE-2011-3453 : Ilja van Sprundel of IOActive
libsecurity Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Some EV certificates may be trusted even if the corresponding root has been marked as untrusted Description: The certificate code trusted a root certificate to sign EV certificates if it was on the list of known EV issuers, even if the user had marked it as 'Never Trust' in Keychain. The root would not be trusted to sign non-EV certificates. CVE-ID CVE-2011-3422 : Alastair Houghton
OpenGL Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Applications that use OS X's OpenGL implementation may be vulnerable to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in the handling of GLSL compilation. CVE-ID CVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and Marc Schoenefeld of the Red Hat Security Response Team
PHP Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Multiple vulnerabilities in PHP 5.3.6 Description: PHP is updated to version 5.3.8 to address several vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP web site at http://www.php.net CVE-ID CVE-2011-1148 CVE-2011-1657 CVE-2011-1938 CVE-2011-2202 CVE-2011-2483 CVE-2011-3182 CVE-2011-3189 CVE-2011-3267 CVE-2011-3268
PHP Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in FreeType's handling of Type 1 fonts. This issue is addressed by updating FreeType to version 2.4.7. Further information is available via the FreeType site at http://www.freetype.org/ CVE-ID CVE-2011-3256 : Apple
PHP Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Multiple vulnerabilities in libpng 1.5.4 Description: libpng is updated to version 1.5.5 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the libpng website at http://www.libpng.org/pub/png/libpng.html CVE-ID CVE-2011-3328
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Opening a maliciously crafted MP4 encoded file may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access issue existed in the handling of MP4 encoded files. CVE-ID CVE-2011-3458 : Luigi Auriemma and pa_kt both working with TippingPoint's Zero Day Initiative
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A signedness issue existed in the handling of font tables embedded in QuickTime movie files. CVE-ID CVE-2011-3248 : Luigi Auriemma working with TippingPoint's Zero Day Initiative
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An off by one buffer overflow existed in the handling of rdrf atoms in QuickTime movie files. CVE-ID CVE-2011-3459 : Luigi Auriemma working with TippingPoint's Zero Day Initiative
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted JPEG2000 image file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 files. CVE-ID CVE-2011-3250 : Luigi Auriemma working with TippingPoint's Zero Day Initiative
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Processing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of PNG files. CVE-ID CVE-2011-3460 : Luigi Auriemma working with TippingPoint's Zero Day Initiative
QuickTime Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of FLC encoded movie files CVE-ID CVE-2011-3249 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero Day Initiative
SquirrelMail Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Multiple vulnerabilities in SquirrelMail Description: SquirrelMail is updated to version 1.4.22 to address several vulnerabilities, the most serious of which is a cross-site scripting issue. This issue does not affect OS X Lion systems. Further information is available via the SquirrelMail web site at http://www.SquirrelMail.org/ CVE-ID CVE-2010-1637 CVE-2010-2813 CVE-2010-4554 CVE-2010-4555 CVE-2011-2023
Subversion Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Accessing a Subversion repository may lead to the disclosure of sensitive information Description: Subversion is updated to version 1.6.17 to address multiple vulnerabilities, the most serious of which may lead to the disclosure of sensitive information. Further information is available via the Subversion web site at http://subversion.tigris.org/ CVE-ID CVE-2011-1752 CVE-2011-1783 CVE-2011-1921
Time Machine Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: A remote attacker may access new backups created by the user's system Description: The user may designate a remote AFP volume or Time Capsule to be used for Time Machine backups. Time Machine did not verify that the same device was being used for subsequent backup operations. An attacker who is able to spoof the remote volume could gain access to new backups created by the user's system. This issue is addressed by verifying the unique identifier associated with a disk for backup operations. CVE-ID CVE-2011-3462 : Michael Roitzsch of the Technische Universitat Dresden
Tomcat Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8 Impact: Multiple vulnerabilities in Tomcat 6.0.32 Description: Tomcat is updated to version 6.0.33 to address multiple vulnerabilities, the most serious of which may lead to the disclosure of sensitive information. Tomcat is only provided on Mac OS X Server systems. This issue does not affect OS X Lion systems. Further information is available via the Tomcat site at http://tomcat.apache.org/ CVE-ID CVE-2011-2204
WebDAV Sharing Available for: OS X Lion Server v10.7 to v10.7.2 Impact: Local users may obtain system privileges Description: An issue existed in WebDAV Sharing's handling of user authentication. A user with a valid account on the server or one of its bound directories could cause the execution of arbitrary code with system privileges. This issue does not affect systems prior to OS X Lion. CVE-ID CVE-2011-3463 : Gordon Davisson of Crywolf
Webmail Available for: OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted e-mail message may lead to the disclosure of message content Description: A cross-site scripting vulnerability existed in the handling of mail messages. This issue is addressed by updating Roundcube Webmail to version 0.6. This issue does not affect systems prior to OS X Lion. Further information is available via the Roundcube site at http://trac.roundcube.net/ CVE-ID CVE-2011-2937
X11 Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2 Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in FreeType's handling of Type 1 fonts. This issue is addressed by updating FreeType to version 2.4.7. Further information is available via the FreeType site at http://www.freetype.org/ CVE-ID CVE-2011-3256 : Apple
OS X Lion v10.7.3 and Security Update 2012-001 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies to your system configuration. Only one is needed, either Security Update 2021-001 or OS X v10.7.3.
For OS X Lion v10.7.2 The download file is named: MacOSXUpd10.7.3.dmg Its SHA-1 digest is: 7102fe8f9f47286c45dfa35f6e84e7f730493a7c
For OS X Lion v10.7 and v10.7.1 The download file is named: MacOSXUpdCombo10.7.3.dmg Its SHA-1 digest is: 07dfce300f6801eb63d9ac13e0bec84e1862a16c
For OS X Lion Server v10.7.2 The download file is named: MacOSXServerUpd10.7.3.dmg Its SHA-1 digest is: 55a9571635d4ec088c142d68132d0d69fcb8867d
For OS X Lion Server v10.7 and v10.7.1 The download file is named: MacOSXServerUpdCombo10.7.3.dmg Its SHA-1 digest is: 2c87824f09734499ea166ea0617a3ac21ecf832b
For Mac OS X v10.6.8 The download file is named: SecUpd2012-001Snow.dmg Its SHA-1 digest is: 40875ee8cb609bbaefc8f421a9c34cc353db42b8
For Mac OS X Server v10.6.8 The download file is named: SecUpdSrvr2012-001.dmg Its SHA-1 digest is: 53b3ca5548001a9920aeabed4a034c6e4657fe20
Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin)
iQEcBAEBAgAGBQJPKYxNAAoJEGnF2JsdZQeeLiIIAMLhH2ipDFrhCsw/n4VDeF1V P6jSkGXC9tBBVMvw1Xq4c2ok4SI34bDfMlURAVR+dde/h6nIZR24aLQVoDLjJuIp RrO2dm1nQeozLJSx2NbxhVh54BucJdKp4xS1GkDNxkqcdh04RE9hRURXdKagnfGy 9P8QQPOQmKAiWos/LYhCPDInMfrpVNvEVwP8MCDP15g6hylN4De/Oyt7ZshPshSf MnAFObfBTGX5KioVqTyfdlBkKUfdXHJux61QEFHn8eadX6+/6IuKbUvK9B0icc8E pvbjOxQatFRps0KNWeIsKQc5i6iQoJhocAiIy6Y6LCuZQuSXCImY2RWXkVYzbWo= =c1eU -----END PGP SIGNATURE----- . ----------------------------------------------------------------------
Join Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria See to the presentation "The Dynamics and Threats of End-Point Software Portfolios" by Secunia's Research Analyst Director, Stefan Frei. Read more: http://conference.first.org/
TITLE: Apache Subversion mod_dav_svn Two Denial of Service Vulnerabilities
SECUNIA ADVISORY ID: SA44681
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44681/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44681
RELEASE DATE: 2011-06-02
DISCUSS ADVISORY: http://secunia.com/advisories/44681/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/44681/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=44681
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Two vulnerabilities have been reported in Apache Subversion, which can be exploited by malicious people to cause a DoS (Denial of Service).
2) An error within the mod_dav_svn module when handling certain path-based access control rules can be exploited to trigger an infinite loop and exhaust memory.
NOTE: A weakness in the handling of path-based access control rules, which could result in certain unreadable files and directories becoming readable has also been reported.
PROVIDED AND/OR DISCOVERED BY: 1) Reported by the vendor 2) The vendor credits Ivan Zhakov, VisualSVN.
ORIGINAL ADVISORY: http://subversion.apache.org/security/CVE-2011-1752-advisory.txt http://subversion.apache.org/security/CVE-2011-1783-advisory.txt http://subversion.apache.org/security/CVE-2011-1921-advisory.txt
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201309-11
http://security.gentoo.org/
Severity: Low Title: Subversion: Multiple vulnerabilities Date: September 23, 2013 Bugs: #350166, #356741, #369065, #463728, #463860, #472202, #482166 ID: 201309-11
Synopsis
Multiple vulnerabilities have been found in Subversion, allowing attackers to cause a Denial of Service, escalate privileges, or obtain sensitive information.
Background
Subversion is a versioning system designed to be a replacement for CVS.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-vcs/subversion < 1.7.13 >= 1.7.13
Description
Multiple vulnerabilities have been discovered in Subversion. Please review the CVE identifiers referenced below for details. A local attacker could escalate his privileges to the user running svnserve.
Workaround
There is no known workaround at this time.
Resolution
All Subversion users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/subversion-1.7.13"
References
[ 1 ] CVE-2010-4539 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4539 [ 2 ] CVE-2010-4644 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4644 [ 3 ] CVE-2011-0715 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0715 [ 4 ] CVE-2011-1752 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1752 [ 5 ] CVE-2011-1783 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1783 [ 6 ] CVE-2011-1921 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1921 [ 7 ] CVE-2013-1845 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1845 [ 8 ] CVE-2013-1846 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1846 [ 9 ] CVE-2013-1847 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1847 [ 10 ] CVE-2013-1849 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1849 [ 11 ] CVE-2013-1884 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1884 [ 12 ] CVE-2013-1968 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1968 [ 13 ] CVE-2013-2088 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2088 [ 14 ] CVE-2013-2112 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2112 [ 15 ] CVE-2013-4131 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4131 [ 16 ] CVE-2013-4277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4277
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201309-11.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2011-1752
The mod_dav_svn Apache HTTPD server module can be crashed though
when asked to deliver baselined WebDAV resources.
For the oldstable distribution (lenny), this problem has been fixed in version 1.5.1dfsg1-7.
For the stable distribution (squeeze), this problem has been fixed in version 1.6.12dfsg-6.
For the unstable distribution (sid), this problem has been fixed in version 1.6.17dfsg-1.
We recommend that you upgrade your subversion packages. ========================================================================== Ubuntu Security Notice USN-1144-1 June 06, 2011
subversion vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
An attacker could send crafted input to the Subversion mod_dav_svn module for Apache and cause it to crash or gain access to restricted files.
Software Description: - subversion: Advanced version control system
Details:
Joe Schaefer discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain baselined WebDAV resource requests. (CVE-2011-1752)
Ivan Zhakov discovered that the Subversion mod_dav_svn module for Apache did not properly handle certain requests. (CVE-2011-1921)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 11.04: libapache2-svn 1.6.12dfsg-4ubuntu2.1
Ubuntu 10.10: libapache2-svn 1.6.12dfsg-1ubuntu1.3
Ubuntu 10.04 LTS: libapache2-svn 1.6.6dfsg-2ubuntu1.3
After a standard system update you need to restart any applications that use Subversion, such as Apache when using mod_dav_svn, to make all the necessary changes.
References: CVE-2011-1752, CVE-2011-1783, CVE-2011-1921
Package Information: https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-4ubuntu2.1 https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-1ubuntu1.3 https://launchpad.net/ubuntu/+source/subversion/1.6.6dfsg-2ubuntu1.3
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201106-0131",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "subversion",
"scope": "lt",
"trust": 1.8,
"vendor": "apache",
"version": "1.6.17"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "debian",
"version": "6.0"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "10.10"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.7.3"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "11.04"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "14"
},
{
"model": "fedora",
"scope": "eq",
"trust": 1.0,
"vendor": "fedoraproject",
"version": "15"
},
{
"model": "ubuntu linux",
"scope": "eq",
"trust": 1.0,
"vendor": "canonical",
"version": "10.04"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "3 (x86-64)"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "4.0"
},
{
"model": "asianux server",
"scope": "eq",
"trust": 0.8,
"vendor": "cybertrust",
"version": "4.0 (x86-64)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.8 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (server)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "4.0"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "enterprise linux eus",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5.6.z (server)"
},
{
"model": "enterprise linux hpc node",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "enterprise linux long life",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "(v. 5.6 server)"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "enterprise linux server eus",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6.1.z"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "6"
},
{
"model": "rhel desktop workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "5 (client)"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.1.3"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.3"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.1"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "0.36.0"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.0"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "0.37.0"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.1.2"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.2"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.5"
},
{
"model": "subversion",
"scope": "eq",
"trust": 0.6,
"vendor": "apache",
"version": "1.0.4"
},
{
"model": "linux armel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.10.2"
},
{
"model": "software foundation subversion",
"scope": "ne",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.17"
},
{
"model": "linux hppa",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.17.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.6"
},
{
"model": "linux enterprise desktop sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.24"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.6"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.9"
},
{
"model": "linux enterprise sdk sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11"
},
{
"model": "software foundation subversion m3",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.15"
},
{
"model": "corporate server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "4.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.8"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.8"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.28.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1.1"
},
{
"model": "enterprise server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "hat enterprise linux server optional",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.9"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.3.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.7"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.0"
},
{
"model": "hat enterprise linux workstation optional",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.37"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.8"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.22.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.35.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.12"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.10.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.6"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.33.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux enterprise sdk sp4",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "pardus",
"version": "20110"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.23"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.36"
},
{
"model": "enterprise linux ws",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.13.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.32.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.0"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.21"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.24.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.22"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.11.1"
},
{
"model": "enterprise linux es",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.18.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.5"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11.4"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.6"
},
{
"model": "hat enterprise linux hpc node optional",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.10.1"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14.3"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.4"
},
{
"model": "software foundation subversion m4/m5",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "hat enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.7"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.7"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.9"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.29"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14.4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.2.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.3.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.8"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1.3"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.10"
},
{
"model": "corporate server",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "4.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.34"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.13.1"
},
{
"model": "linux sparc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.2.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.4"
},
{
"model": "enterprise linux desktop version",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "4"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.1"
},
{
"model": "hat enterprise linux workstation",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "message networking",
"scope": "eq",
"trust": 0.3,
"vendor": "avaya",
"version": "3.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.6"
},
{
"model": "linux",
"scope": null,
"trust": 0.3,
"vendor": "gentoo",
"version": null
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.4.5"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"model": "enterprise linux desktop workstation client",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.15"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.18"
},
{
"model": "linux alpha",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.19.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.3"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.16"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1.4"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "10.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.26"
},
{
"model": "linux powerpc",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.3.1"
},
{
"model": "mac os",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"model": "software foundation subversion m1",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "mac os server",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.3"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.13"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.6"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "ubuntu",
"version": "11.04"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.1.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.7"
},
{
"model": "linux s/390",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.19"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6"
},
{
"model": "linux enterprise sdk sp3",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "10"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14.1"
},
{
"model": "linux amd64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.33"
},
{
"model": "software foundation subversion m2",
"scope": null,
"trust": 0.3,
"vendor": "apache",
"version": null
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.20"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.16.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.30"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.0.7"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.25"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.28.2"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.5.8"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.2.3"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.28"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.14.5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.35"
},
{
"model": "hat enterprise linux server",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.16"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "pardus",
"version": "20090"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.12"
},
{
"model": "linux ia-32",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mipsel",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "linux mips",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.13"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.27"
},
{
"model": "hat enterprise linux desktop optional",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "6"
},
{
"model": "enterprise server x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandrakesoft",
"version": "5"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.20.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.17"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.31"
},
{
"model": "linux mandrake x86 64",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2009.0"
},
{
"model": "hat enterprise linux as",
"scope": "eq",
"trust": 0.3,
"vendor": "red",
"version": "4"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.22.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.4"
},
{
"model": "linux m68k",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "opensuse",
"scope": "eq",
"trust": 0.3,
"vendor": "suse",
"version": "11.3"
},
{
"model": "linux arm",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "0.24.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.7.1"
},
{
"model": "software foundation subversion",
"scope": "eq",
"trust": 0.3,
"vendor": "apache",
"version": "1.6.5"
},
{
"model": "linux mandrake",
"scope": "eq",
"trust": 0.3,
"vendor": "mandriva",
"version": "2010.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.6.3"
},
{
"model": "linux ia-64",
"scope": "eq",
"trust": 0.3,
"vendor": "debian",
"version": "5.0"
}
],
"sources": [
{
"db": "BID",
"id": "48091"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "1.6.17",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "10.7.3",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\u0026lt;br\u0026gt;Joe Schaefer of Apache Software Foundation, Ivan Zhakov of VisualSVN, and Kamesh Jayachandran of CollabNet.",
"sources": [
{
"db": "BID",
"id": "48091"
}
],
"trust": 0.3
},
"cve": "CVE-2011-1752",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2011-1752",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-49697",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-1752",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201106-021",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-49697",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011. Apache Subversion is prone to multiple vulnerabilities, including two denial-of-service issues and an information-disclosure issue. \nAttackers can exploit these issues to crash the application, exhaust all memory resources, or obtain potentially sensitive information. \nVersions prior to Subversion 1.6.17 are vulnerable. \n \n The mod_dav_svn Apache HTTPD server module may in certain cenarios\n enter a logic loop which does not exit and which allocates emory in\n each iteration, ultimately exhausting all the available emory on the\n server which can lead to a DoS (Denial Of Service) (CVE-2011-1783). \n \n The mod_dav_svn Apache HTTPD server module may leak to remote users\n the file contents of files configured to be unreadable by those users\n (CVE-2011-1921). \n \n Packages for 2009.0 are provided as of the Extended Maintenance\n Program. Please visit this link to learn more:\n http://store.mandriva.com/product_info.php?cPath=149\u0026amp;products_id=490\n \n The updated packages have been upgraded to the 1.6.17 version which\n is not vulnerable to these issues. \n _______________________________________________________________________\n\n References:\n\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1752\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1783\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1921\n http://svn.apache.org/repos/asf/subversion/tags/1.6.17/CHANGES\n _______________________________________________________________________\n\n Updated Packages:\n\n Mandriva Linux 2009.0:\n b7dcf908858e788c0321e13109163494 2009.0/i586/apache-mod_dav_svn-1.6.17-0.1mdv2009.0.i586.rpm\n c403bbd6aedcd9426dc5cf72ef56d1a9 2009.0/i586/apache-mod_dontdothat-1.6.17-0.1mdv2009.0.i586.rpm\n 2f3d2373aed96710023c6a84819731f6 2009.0/i586/libsvn0-1.6.17-0.1mdv2009.0.i586.rpm\n 2b4a273ce742b44b5a18bfaba5b9e6af 2009.0/i586/libsvnjavahl1-1.6.17-0.1mdv2009.0.i586.rpm\n e11fb3f919ab6358d3a3ac26d803715f 2009.0/i586/perl-SVN-1.6.17-0.1mdv2009.0.i586.rpm\n 745a88c6044f3cf2fda88bfc80500c1a 2009.0/i586/python-svn-1.6.17-0.1mdv2009.0.i586.rpm\n 7baab70f65cac6de36cede330f032cc5 2009.0/i586/ruby-svn-1.6.17-0.1mdv2009.0.i586.rpm\n c15bd5f296328d65f2612a61238b0f01 2009.0/i586/subversion-1.6.17-0.1mdv2009.0.i586.rpm\n b6c69f4a93490250bc4c1c29a51d0301 2009.0/i586/subversion-devel-1.6.17-0.1mdv2009.0.i586.rpm\n 6b780c034fcf7caa146ac495f74776fd 2009.0/i586/subversion-doc-1.6.17-0.1mdv2009.0.i586.rpm\n 51e8efe6c17057098eec1e9b0d9b305e 2009.0/i586/subversion-server-1.6.17-0.1mdv2009.0.i586.rpm\n f974ca62b90d4db1f3eeb0dc80a06787 2009.0/i586/subversion-tools-1.6.17-0.1mdv2009.0.i586.rpm\n 804da077e30821641755625cb9f6f545 2009.0/i586/svn-javahl-1.6.17-0.1mdv2009.0.i586.rpm \n 9ac126adb88c745c67e55630c98f1dff 2009.0/SRPMS/subversion-1.6.17-0.1mdv2009.0.src.rpm\n\n Mandriva Linux 2009.0/X86_64:\n adf776406f42c9bb4c5928f8d16ad74f 2009.0/x86_64/apache-mod_dav_svn-1.6.17-0.1mdv2009.0.x86_64.rpm\n f35384b836889e04b9d732045deacccb 2009.0/x86_64/apache-mod_dontdothat-1.6.17-0.1mdv2009.0.x86_64.rpm\n cff7dcefaf6e8c3d0a7642a36661e803 2009.0/x86_64/lib64svn0-1.6.17-0.1mdv2009.0.x86_64.rpm\n 01019c76de0636f512bc1338a180ab1b 2009.0/x86_64/lib64svnjavahl1-1.6.17-0.1mdv2009.0.x86_64.rpm\n 74812d1b64db5301b1ed74db46dc08b6 2009.0/x86_64/perl-SVN-1.6.17-0.1mdv2009.0.x86_64.rpm\n 59e84aa6043fae46047327ac124771e9 2009.0/x86_64/python-svn-1.6.17-0.1mdv2009.0.x86_64.rpm\n 15fae543266ede69fa220419ca91bc8f 2009.0/x86_64/ruby-svn-1.6.17-0.1mdv2009.0.x86_64.rpm\n cd9be5e2b3ba9497e7f8e42a8d0181e0 2009.0/x86_64/subversion-1.6.17-0.1mdv2009.0.x86_64.rpm\n 8e14979cf0ac190035fcb0ae994fe4d8 2009.0/x86_64/subversion-devel-1.6.17-0.1mdv2009.0.x86_64.rpm\n 4c2e1922b12202697983b567638c9b92 2009.0/x86_64/subversion-doc-1.6.17-0.1mdv2009.0.x86_64.rpm\n a7e5997dc660568bafed59a7bab37578 2009.0/x86_64/subversion-server-1.6.17-0.1mdv2009.0.x86_64.rpm\n 936dc2d30cc5bb8f54b32d862af63f3d 2009.0/x86_64/subversion-tools-1.6.17-0.1mdv2009.0.x86_64.rpm\n e40d82e0b13a180d2a3c2ed2cd356e52 2009.0/x86_64/svn-javahl-1.6.17-0.1mdv2009.0.x86_64.rpm \n 9ac126adb88c745c67e55630c98f1dff 2009.0/SRPMS/subversion-1.6.17-0.1mdv2009.0.src.rpm\n\n Mandriva Linux 2010.1:\n 809c8316c0cf26a1aa7a26260ebd556b 2010.1/i586/apache-mod_dav_svn-1.6.17-0.1mdv2010.2.i586.rpm\n 1c5aa3316d62eb40cbda3e91b5a0dead 2010.1/i586/apache-mod_dontdothat-1.6.17-0.1mdv2010.2.i586.rpm\n 680745e35e66433826514dc65f748597 2010.1/i586/libsvn0-1.6.17-0.1mdv2010.2.i586.rpm\n 2e523e3262c4fa0d918f6667c8c00bf1 2010.1/i586/libsvn-gnome-keyring0-1.6.17-0.1mdv2010.2.i586.rpm\n 5b8802e18a6e594676823ec01348143b 2010.1/i586/libsvnjavahl1-1.6.17-0.1mdv2010.2.i586.rpm\n 2d9d773efd8a108b59dd774d6030681e 2010.1/i586/libsvn-kwallet0-1.6.17-0.1mdv2010.2.i586.rpm\n 786cd1f13ee58d23e8246b37991f3a4c 2010.1/i586/perl-SVN-1.6.17-0.1mdv2010.2.i586.rpm\n f718ab77c2b5c77e2b49b38604f4663f 2010.1/i586/python-svn-1.6.17-0.1mdv2010.2.i586.rpm\n e006b5cef023e652caf2281a197e848a 2010.1/i586/ruby-svn-1.6.17-0.1mdv2010.2.i586.rpm\n a7f25d127ad47dde81e72f947a425311 2010.1/i586/subversion-1.6.17-0.1mdv2010.2.i586.rpm\n 2e8997143a4e9caccd531496b3d01acc 2010.1/i586/subversion-devel-1.6.17-0.1mdv2010.2.i586.rpm\n 1102fa83a4d71bb78410fcf52e240a6a 2010.1/i586/subversion-doc-1.6.17-0.1mdv2010.2.i586.rpm\n f7d57f0fb38326ef4a94f17ece68071e 2010.1/i586/subversion-server-1.6.17-0.1mdv2010.2.i586.rpm\n 371566535452839fd3f56d0fd1949083 2010.1/i586/subversion-tools-1.6.17-0.1mdv2010.2.i586.rpm\n 1625168460442b3044986aec02642ceb 2010.1/i586/svn-javahl-1.6.17-0.1mdv2010.2.i586.rpm \n 3186570aa3e04f22d98a28e75a394710 2010.1/SRPMS/subversion-1.6.17-0.1mdv2010.2.src.rpm\n\n Mandriva Linux 2010.1/X86_64:\n 5e499d3c40941455d1b37dbf5773991e 2010.1/x86_64/apache-mod_dav_svn-1.6.17-0.1mdv2010.2.x86_64.rpm\n 0aa267a7b319e2a30960ee2a5414d80e 2010.1/x86_64/apache-mod_dontdothat-1.6.17-0.1mdv2010.2.x86_64.rpm\n 35cdd975fcec1b990d51bdb9f1714bf4 2010.1/x86_64/lib64svn0-1.6.17-0.1mdv2010.2.x86_64.rpm\n 4278a8f843fb04cd2850eaa64cb0f568 2010.1/x86_64/lib64svn-gnome-keyring0-1.6.17-0.1mdv2010.2.x86_64.rpm\n d2c973cce463ac11b543c93e70c8aed9 2010.1/x86_64/lib64svnjavahl1-1.6.17-0.1mdv2010.2.x86_64.rpm\n 80302dffc3708392c44c71e8beb5318c 2010.1/x86_64/lib64svn-kwallet0-1.6.17-0.1mdv2010.2.x86_64.rpm\n 326ef2d296d29e081afb3191af5212ef 2010.1/x86_64/perl-SVN-1.6.17-0.1mdv2010.2.x86_64.rpm\n 3ebaa0c7e51c6607cbb15d032793126c 2010.1/x86_64/python-svn-1.6.17-0.1mdv2010.2.x86_64.rpm\n 7fac98a4b1457fdd628c0f9ac342497a 2010.1/x86_64/ruby-svn-1.6.17-0.1mdv2010.2.x86_64.rpm\n 5291fcc25554166520cab2642fbdf166 2010.1/x86_64/subversion-1.6.17-0.1mdv2010.2.x86_64.rpm\n 8b18da0f0e6e8a39f56774395c73eb21 2010.1/x86_64/subversion-devel-1.6.17-0.1mdv2010.2.x86_64.rpm\n 5e645e03996129bb649ca39a24a09496 2010.1/x86_64/subversion-doc-1.6.17-0.1mdv2010.2.x86_64.rpm\n ceb52200e4ebfeadec2d48c2c7b5fd4d 2010.1/x86_64/subversion-server-1.6.17-0.1mdv2010.2.x86_64.rpm\n 95aff7b1b38a5a26a58b44e3984d3d89 2010.1/x86_64/subversion-tools-1.6.17-0.1mdv2010.2.x86_64.rpm\n 968576b20dd363a6899c4c7eefe8b614 2010.1/x86_64/svn-javahl-1.6.17-0.1mdv2010.2.x86_64.rpm \n 3186570aa3e04f22d98a28e75a394710 2010.1/SRPMS/subversion-1.6.17-0.1mdv2010.2.src.rpm\n\n Corporate 4.0:\n b424fc4dea5b090cc831a9b26996bb72 corporate/4.0/i586/apache-mod_dav_svn-1.6.17-0.1.20060mlcs4.i586.rpm\n 66fd3f68ab4e67043c7bb06bf0f5aaeb corporate/4.0/i586/apache-mod_dontdothat-1.6.17-0.1.20060mlcs4.i586.rpm\n cc441dda9a371692b8412af0c0b994b8 corporate/4.0/i586/libsvn0-1.6.17-0.1.20060mlcs4.i586.rpm\n f6005206e732c2f8484e6d49e4b26145 corporate/4.0/i586/perl-SVN-1.6.17-0.1.20060mlcs4.i586.rpm\n ed2db70bc8a07fe65980e4ca57abb682 corporate/4.0/i586/python-svn-1.6.17-0.1.20060mlcs4.i586.rpm\n ea7940a13e22f15181076d9fda196b3c corporate/4.0/i586/subversion-1.6.17-0.1.20060mlcs4.i586.rpm\n 93a99bf395142992eb853fde5ea11df0 corporate/4.0/i586/subversion-devel-1.6.17-0.1.20060mlcs4.i586.rpm\n 9498abb347b8bda55c0d16eb24b632d8 corporate/4.0/i586/subversion-doc-1.6.17-0.1.20060mlcs4.i586.rpm\n 0417594b6d75639b515d6154494bd982 corporate/4.0/i586/subversion-server-1.6.17-0.1.20060mlcs4.i586.rpm\n 9e8f089fbf491f5461b4cd3adf352105 corporate/4.0/i586/subversion-tools-1.6.17-0.1.20060mlcs4.i586.rpm \n 229c77a2d2172dbb17cc496d169e8dec corporate/4.0/SRPMS/subversion-1.6.17-0.1.20060mlcs4.src.rpm\n\n Corporate 4.0/X86_64:\n e992b482857ea06a007d88357fb5000b corporate/4.0/x86_64/apache-mod_dav_svn-1.6.17-0.1.20060mlcs4.x86_64.rpm\n 60c10a01326c435570ff1c009de7e545 corporate/4.0/x86_64/apache-mod_dontdothat-1.6.17-0.1.20060mlcs4.x86_64.rpm\n 3c9826dc51d1a6b6289a8c123edb4803 corporate/4.0/x86_64/lib64svn0-1.6.17-0.1.20060mlcs4.x86_64.rpm\n 061c8703b664f7243d57c36f560c037c corporate/4.0/x86_64/perl-SVN-1.6.17-0.1.20060mlcs4.x86_64.rpm\n ba61070e3084b50f3d3196911ee9004b corporate/4.0/x86_64/python-svn-1.6.17-0.1.20060mlcs4.x86_64.rpm\n e87e651ac237c9425e1a2650f9761fe9 corporate/4.0/x86_64/subversion-1.6.17-0.1.20060mlcs4.x86_64.rpm\n feb1ad3849b68b49b38e124db0b0d633 corporate/4.0/x86_64/subversion-devel-1.6.17-0.1.20060mlcs4.x86_64.rpm\n a0ed185c8c0aa4e4b0186f8aa08dc6b4 corporate/4.0/x86_64/subversion-doc-1.6.17-0.1.20060mlcs4.x86_64.rpm\n 0d9bdee90a50428480922d2e882f6fe3 corporate/4.0/x86_64/subversion-server-1.6.17-0.1.20060mlcs4.x86_64.rpm\n e5afc579bb3fbc44509241e010549e53 corporate/4.0/x86_64/subversion-tools-1.6.17-0.1.20060mlcs4.x86_64.rpm \n 229c77a2d2172dbb17cc496d169e8dec corporate/4.0/SRPMS/subversion-1.6.17-0.1.20060mlcs4.src.rpm\n\n Mandriva Enterprise Server 5:\n d8165cb83dada65ebc80808c55c99f5d mes5/i586/apache-mod_dav_svn-1.6.17-0.1mdvmes5.2.i586.rpm\n 5e653275497d01bab284741d509fcc20 mes5/i586/apache-mod_dontdothat-1.6.17-0.1mdvmes5.2.i586.rpm\n 93ce20f3fc00bf2b0d2136b7c35538ed mes5/i586/libsvn0-1.6.17-0.1mdvmes5.2.i586.rpm\n c8602d9ca59963d8f288d7c1ea718cb3 mes5/i586/libsvnjavahl1-1.6.17-0.1mdvmes5.2.i586.rpm\n f148fab1eedbcf9a9f19d3e60c6cfadf mes5/i586/perl-SVN-1.6.17-0.1mdvmes5.2.i586.rpm\n d631ac32c1563680d7c5cc9bcbfcfb6b mes5/i586/python-svn-1.6.17-0.1mdvmes5.2.i586.rpm\n 06f830bce3b8e01f2fd40b5c637ab986 mes5/i586/ruby-svn-1.6.17-0.1mdvmes5.2.i586.rpm\n 357ceb371acfcd3eb9cd88caa107a53b mes5/i586/subversion-1.6.17-0.1mdvmes5.2.i586.rpm\n b3aa7097cb52e07a775653d822aa7dba mes5/i586/subversion-devel-1.6.17-0.1mdvmes5.2.i586.rpm\n 798e56237c5ea86ad3f78dc28efe5872 mes5/i586/subversion-doc-1.6.17-0.1mdvmes5.2.i586.rpm\n 973d3c726f9d0c502acfeacad69ac614 mes5/i586/subversion-server-1.6.17-0.1mdvmes5.2.i586.rpm\n 46f2b4d4539d7da8848a182a9b28afbd mes5/i586/subversion-tools-1.6.17-0.1mdvmes5.2.i586.rpm\n 56254352fdc6c10f56e03b8a50089105 mes5/i586/svn-javahl-1.6.17-0.1mdvmes5.2.i586.rpm \n c036e0758d2b25ecaf2b2773306dc9f1 mes5/SRPMS/subversion-1.6.17-0.1mdvmes5.2.src.rpm\n\n Mandriva Enterprise Server 5/X86_64:\n e41d3cd15e340df2903d1ae5fcaa958e mes5/x86_64/apache-mod_dav_svn-1.6.17-0.1mdvmes5.2.x86_64.rpm\n d84d598685b49e33b29b99e73bd25e61 mes5/x86_64/apache-mod_dontdothat-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 67cc1d9ac7ac69fa494bb3c0c3ab1b24 mes5/x86_64/lib64svn0-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 0c93407253c6456cf47ac40fdf903ae0 mes5/x86_64/lib64svnjavahl1-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 9662f86183093a782ff143ff1c3f61a8 mes5/x86_64/perl-SVN-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 74879ef216a0286b463c8713e1045b43 mes5/x86_64/python-svn-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 032060ecadfbfaff5c94a2df6b7b1157 mes5/x86_64/ruby-svn-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 4ca2ddde563edde87e5864e419db655b mes5/x86_64/subversion-1.6.17-0.1mdvmes5.2.x86_64.rpm\n a7690a8ee3c367539958d740bd885252 mes5/x86_64/subversion-devel-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 6b1d4297f49e1703a69e5c73ee380686 mes5/x86_64/subversion-doc-1.6.17-0.1mdvmes5.2.x86_64.rpm\n 316dc293f1c4871b9833ecffc7e809b0 mes5/x86_64/subversion-server-1.6.17-0.1mdvmes5.2.x86_64.rpm\n d644829032a7bf93945ef6376cf1ed9c mes5/x86_64/subversion-tools-1.6.17-0.1mdvmes5.2.x86_64.rpm\n b25e044ca25e3891dfd4699b94bc10e2 mes5/x86_64/svn-javahl-1.6.17-0.1mdvmes5.2.x86_64.rpm \n c036e0758d2b25ecaf2b2773306dc9f1 mes5/SRPMS/subversion-1.6.17-0.1mdvmes5.2.src.rpm\n _______________________________________________________________________\n\n To upgrade automatically use MandrivaUpdate or urpmi. The verification\n of md5 checksums and GPG signatures is performed automatically for you. \n\n All packages are signed by Mandriva for security. You can obtain the\n GPG public key of the Mandriva Security Team by executing:\n\n gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98\n\n You can view other update advisories for Mandriva Linux at:\n\n http://www.mandriva.com/security/advisories\n\n If you want to report vulnerabilities, please contact\n\n security_(at)_mandriva.com\n _______________________________________________________________________\n\n Type Bits/KeyID Date User ID\n pub 1024D/22458A98 2000-07-10 Mandriva Security Team\n \u003csecurity*mandriva.com\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.9 (GNU/Linux)\n\niD8DBQFN6cg2mqjQ0CJFipgRAqj2AKCRyKt813e0OmWSTU5bL58KCmUwowCfT6RY\nDDOtowgSctAg4EX+tLXIvRQ=\n=zsmM\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nAPPLE-SA-2012-02-01-1 OS X Lion v10.7.3 and Security Update 2012-001\n\nOS X Lion v10.7.3 and Security Update 2012-001 is now available and\naddresses the following:\n\nAddress Book\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: An attacker in a privileged network position may intercept\nCardDAV data\nDescription: Address Book supports Secure Sockets Layer (SSL) for\naccessing CardDAV. A downgrade issue caused Address Book to attempt\nan unencrypted connection if an encrypted connection failed. An\nattacker in a privileged network position could abuse this behavior\nto intercept CardDAV data. This issue is addressed by not downgrading\nto an unencrypted connection without user approval. \nCVE-ID\nCVE-2011-3444 : Bernard Desruisseaux of Oracle Corporation\n\nApache\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Multiple vulnerabilities in Apache\nDescription: Apache is updated to version 2.2.21 to address several\nvulnerabilities, the most serious of which may lead to a denial of\nservice. Further information is available via the Apache web site at\nhttp://httpd.apache.org/\nCVE-ID\nCVE-2011-3348\n\nApache\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: An attacker may be able to decrypt data protected by SSL\nDescription: There are known attacks on the confidentiality of SSL\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. \nApache disabled the \u0027empty fragment\u0027 countermeasure which prevented\nthese attacks. This issue is addressed by providing a configuration\nparameter to control the countermeasure and enabling it by default. \nCVE-ID\nCVE-2011-3389\n\nCFNetwork\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Visiting a maliciously crafted website may lead to the\ndisclosure of sensitive information\nDescription: An issue existed in CFNetwork\u0027s handling of malformed\nURLs. When accessing a maliciously crafted URL, CFNetwork could send\nthe request to an incorrect origin server. This issue does not affect\nsystems prior to OS X Lion. \nCVE-ID\nCVE-2011-3246 : Erling Ellingsen of Facebook\n\nCFNetwork\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Visiting a maliciously crafted website may lead to the\ndisclosure of sensitive information\nDescription: An issue existed in CFNetwork\u0027s handling of malformed\nURLs. When accessing a maliciously crafted URL, CFNetwork could send\nunexpected request headers. This issue does not affect systems prior\nto OS X Lion. \nCVE-ID\nCVE-2011-3447 : Erling Ellingsen of Facebook\n\nColorSync\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\nImpact: Viewing a maliciously crafted image with an embedded\nColorSync profile may lead to an unexpected application termination\nor arbitrary code execution\nDescription: An integer overflow existed in the handling of images\nwith an embedded ColorSync profile, which may lead to a heap buffer\noverflow. This issue does not affect OS X Lion systems. \nCVE-ID\nCVE-2011-0200 : binaryproof working with TippingPoint\u0027s Zero Day\nInitiative\n\nCoreAudio\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\nImpact: Playing maliciously crafted audio content may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of AAC\nencoded audio streams. This issue does not affect OS X Lion systems. \nCVE-ID\nCVE-2011-3252 : Luigi Auriemma working with TippingPoint\u0027s Zero Day\nInitiative\n\nCoreMedia\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A heap buffer overflow existed in CoreMedia\u0027s handling\nof H.264 encoded movie files. \nCVE-ID\nCVE-2011-3448 : Scott Stender of iSEC Partners\n\nCoreText\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing or downloading a document containing a maliciously\ncrafted embedded font may lead to an unexpected application\ntermination or arbitrary code execution\nDescription: A use after free issue existed in the handling of font\nfiles. \nCVE-ID\nCVE-2011-3449 : Will Dormann of the CERT/CC\n\nCoreUI\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Visiting a malicious website may lead to an unexpected\napplication termination or arbitrary code execution\nDescription: An unbounded stack allocation issue existed in the\nhandling of long URLs. This issue does not affect systems prior to OS\nX Lion. \nCVE-ID\nCVE-2011-3450 : Ben Syverson\n\ncurl\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: A remote server may be able to impersonate clients via\nGSSAPI requests\nDescription: When doing GSSAPI authentication, libcurl\nunconditionally performs credential delegation. This issue is\naddressed by disabling GSSAPI credential delegation. \nCVE-ID\nCVE-2011-2192\n\nData Security\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: An attacker with a privileged network position may intercept\nuser credentials or other sensitive information\nDescription: Two certificate authorities in the list of trusted root\ncertificates have independently issued intermediate certificates to\nDigiCert Malaysia. DigiCert Malaysia has issued certificates with\nweak keys that it is unable to revoke. An attacker with a privileged\nnetwork position could intercept user credentials or other sensitive\ninformation intended for a site with a certificate issued by DigiCert\nMalaysia. This issue is addressed by configuring default system trust\nsettings so that DigiCert Malaysia\u0027s certificates are not trusted. We\nwould like to acknowledge Bruce Morton of Entrust, Inc. for reporting\nthis issue. \n\ndovecot\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: An attacker may be able to decrypt data protected by SSL\nDescription: There are known attacks on the confidentiality of SSL\n3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. \nDovecot disabled the \u0027empty fragment\u0027 countermeasure which prevented\nthese attacks. This issue is addressed by enabling the\ncountermeasure. \nCVE-ID\nCVE-2011-3389 : Apple\n\nfilecmds\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Decompressing a maliciously crafted compressed file may lead\nto an unexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the \u0027uncompress\u0027 command\nline tool. \nCVE-ID\nCVE-2011-2895\n\nImageIO\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\nImpact: Viewing a maliciously crafted TIFF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in ImageIO\u0027s handling of\nCCITT Group 4 encoded TIFF files. This issue does not affect OS X\nLion systems. \nCVE-ID\nCVE-2011-0241 : Cyril CATTIAUX of Tessi Technologies\n\nImageIO\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted TIFF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in libtiff\u0027s handling of\nThunderScan encoded TIFF images. This issue is address by updating\nlibtiff to version 3.9.5. \nCVE-ID\nCVE-2011-1167\n\nImageIO\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Multiple vulnerabilities in libpng 1.5.4\nDescription: libpng is updated to version 1.5.5 to address multiple\nvulnerabilities, the most serious of which may lead to arbitrary code\nexecution. Further information is available via the libpng website at\nhttp://www.libpng.org/pub/png/libpng.html\nCVE-ID\nCVE-2011-3328\n\nInternet Sharing\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: A Wi-Fi network created by Internet Sharing may lose\nsecurity settings after a system update\nDescription: After updating to a version of OS X Lion prior to\n10.7.3, the Wi-Fi configuration used by Internet Sharing may revert\nto factory defaults, which disables the WEP password. This issue only\naffects systems with Internet Sharing enabled and sharing the\nconnection to Wi-Fi. This issue is addressed by preserving the Wi-Fi\nconfiguration during a system update. \nCVE-ID\nCVE-2011-3452 : an anonymous researcher\n\nLibinfo\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Visiting a maliciously crafted website may lead to the\ndisclosure of sensitive information\nDescription: An issue existed in Libinfo\u0027s handling of hostname\nlookup requests. Libinfo could return incorrect results for a\nmaliciously crafted hostname. This issue does not affect systems\nprior to OS X Lion. \nCVE-ID\nCVE-2011-3441 : Erling Ellingsen of Facebook\n\nlibresolv\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Applications that use OS X\u0027s libresolv library may be\nvulnerable to an unexpected application termination or arbitrary code\nexecution\nDescription: An integer overflow existed in the parsing of DNS\nresource records, which may lead to heap memory corruption. \nCVE-ID\nCVE-2011-3453 : Ilja van Sprundel of IOActive\n\nlibsecurity\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Some EV certificates may be trusted even if the\ncorresponding root has been marked as untrusted\nDescription: The certificate code trusted a root certificate to sign\nEV certificates if it was on the list of known EV issuers, even if\nthe user had marked it as \u0027Never Trust\u0027 in Keychain. The root would\nnot be trusted to sign non-EV certificates. \nCVE-ID\nCVE-2011-3422 : Alastair Houghton\n\nOpenGL\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Applications that use OS X\u0027s OpenGL implementation may be\nvulnerable to an unexpected application termination or arbitrary code\nexecution\nDescription: Multiple memory corruption issues existed in the\nhandling of GLSL compilation. \nCVE-ID\nCVE-2011-3457 : Chris Evans of the Google Chrome Security Team, and\nMarc Schoenefeld of the Red Hat Security Response Team\n\nPHP\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Multiple vulnerabilities in PHP 5.3.6\nDescription: PHP is updated to version 5.3.8 to address several\nvulnerabilities, the most serious of which may lead to arbitrary code\nexecution. Further information is available via the PHP web site at\nhttp://www.php.net\nCVE-ID\nCVE-2011-1148\nCVE-2011-1657\nCVE-2011-1938\nCVE-2011-2202\nCVE-2011-2483\nCVE-2011-3182\nCVE-2011-3189\nCVE-2011-3267\nCVE-2011-3268\n\nPHP\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in FreeType\u0027s\nhandling of Type 1 fonts. This issue is addressed by updating\nFreeType to version 2.4.7. Further information is available via the\nFreeType site at http://www.freetype.org/\nCVE-ID\nCVE-2011-3256 : Apple\n\nPHP\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Multiple vulnerabilities in libpng 1.5.4\nDescription: libpng is updated to version 1.5.5 to address multiple\nvulnerabilities, the most serious of which may lead to arbitrary code\nexecution. Further information is available via the libpng website at\nhttp://www.libpng.org/pub/png/libpng.html\nCVE-ID\nCVE-2011-3328\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Opening a maliciously crafted MP4 encoded file may lead to\nan unexpected application termination or arbitrary code execution\nDescription: An uninitialized memory access issue existed in the\nhandling of MP4 encoded files. \nCVE-ID\nCVE-2011-3458 : Luigi Auriemma and pa_kt both working with\nTippingPoint\u0027s Zero Day Initiative\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A signedness issue existed in the handling of font\ntables embedded in QuickTime movie files. \nCVE-ID\nCVE-2011-3248 : Luigi Auriemma working with TippingPoint\u0027s Zero Day\nInitiative\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An off by one buffer overflow existed in the handling\nof rdrf atoms in QuickTime movie files. \nCVE-ID\nCVE-2011-3459 : Luigi Auriemma working with TippingPoint\u0027s Zero Day\nInitiative\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted JPEG2000 image file may lead\nto an unexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of JPEG2000\nfiles. \nCVE-ID\nCVE-2011-3250 : Luigi Auriemma working with TippingPoint\u0027s Zero Day\nInitiative\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Processing a maliciously crafted PNG image may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of PNG files. \nCVE-ID\nCVE-2011-3460 : Luigi Auriemma working with TippingPoint\u0027s Zero Day\nInitiative\n\nQuickTime\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted movie file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A buffer overflow existed in the handling of FLC\nencoded movie files\nCVE-ID\nCVE-2011-3249 : Matt \u0027j00ru\u0027 Jurczyk working with TippingPoint\u0027s Zero\nDay Initiative\n\nSquirrelMail\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\nImpact: Multiple vulnerabilities in SquirrelMail\nDescription: SquirrelMail is updated to version 1.4.22 to address\nseveral vulnerabilities, the most serious of which is a cross-site\nscripting issue. This issue does not affect OS X Lion systems. \nFurther information is available via the SquirrelMail web site at\nhttp://www.SquirrelMail.org/\nCVE-ID\nCVE-2010-1637\nCVE-2010-2813\nCVE-2010-4554\nCVE-2010-4555\nCVE-2011-2023\n\nSubversion\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Accessing a Subversion repository may lead to the disclosure\nof sensitive information\nDescription: Subversion is updated to version 1.6.17 to address\nmultiple vulnerabilities, the most serious of which may lead to the\ndisclosure of sensitive information. Further information is available\nvia the Subversion web site at http://subversion.tigris.org/\nCVE-ID\nCVE-2011-1752\nCVE-2011-1783\nCVE-2011-1921\n\nTime Machine\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: A remote attacker may access new backups created by the\nuser\u0027s system\nDescription: The user may designate a remote AFP volume or Time\nCapsule to be used for Time Machine backups. Time Machine did not\nverify that the same device was being used for subsequent backup\noperations. An attacker who is able to spoof the remote volume could\ngain access to new backups created by the user\u0027s system. This issue\nis addressed by verifying the unique identifier associated with a\ndisk for backup operations. \nCVE-ID\nCVE-2011-3462 : Michael Roitzsch of the Technische Universitat\nDresden\n\nTomcat\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8\nImpact: Multiple vulnerabilities in Tomcat 6.0.32\nDescription: Tomcat is updated to version 6.0.33 to address multiple\nvulnerabilities, the most serious of which may lead to the disclosure\nof sensitive information. Tomcat is only provided on Mac OS X Server\nsystems. This issue does not affect OS X Lion systems. Further\ninformation is available via the Tomcat site at\nhttp://tomcat.apache.org/\nCVE-ID\nCVE-2011-2204\n\nWebDAV Sharing\nAvailable for: OS X Lion Server v10.7 to v10.7.2\nImpact: Local users may obtain system privileges\nDescription: An issue existed in WebDAV Sharing\u0027s handling of user\nauthentication. A user with a valid account on the server or one of\nits bound directories could cause the execution of arbitrary code\nwith system privileges. This issue does not affect systems prior to\nOS X Lion. \nCVE-ID\nCVE-2011-3463 : Gordon Davisson of Crywolf\n\nWebmail\nAvailable for: OS X Lion v10.7 to v10.7.2,\nOS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted e-mail message may lead to the\ndisclosure of message content\nDescription: A cross-site scripting vulnerability existed in the\nhandling of mail messages. This issue is addressed by updating\nRoundcube Webmail to version 0.6. This issue does not affect systems\nprior to OS X Lion. Further information is available via the\nRoundcube site at http://trac.roundcube.net/\nCVE-ID\nCVE-2011-2937\n\nX11\nAvailable for: Mac OS X v10.6.8, Mac OS X Server v10.6.8,\nOS X Lion v10.7 to v10.7.2, OS X Lion Server v10.7 to v10.7.2\nImpact: Viewing a maliciously crafted PDF file may lead to an\nunexpected application termination or arbitrary code execution\nDescription: A memory corruption issue existed in FreeType\u0027s\nhandling of Type 1 fonts. This issue is addressed by updating\nFreeType to version 2.4.7. Further information is available via the\nFreeType site at http://www.freetype.org/\nCVE-ID\nCVE-2011-3256 : Apple\n\nOS X Lion v10.7.3 and Security Update 2012-001 may be obtained from\nthe Software Update pane in System Preferences, or Apple\u0027s Software\nDownloads web site:\nhttp://www.apple.com/support/downloads/\n\nThe Software Update utility will present the update that applies\nto your system configuration. Only one is needed, either\nSecurity Update 2021-001 or OS X v10.7.3. \n\nFor OS X Lion v10.7.2\nThe download file is named: MacOSXUpd10.7.3.dmg\nIts SHA-1 digest is: 7102fe8f9f47286c45dfa35f6e84e7f730493a7c\n\nFor OS X Lion v10.7 and v10.7.1\nThe download file is named: MacOSXUpdCombo10.7.3.dmg\nIts SHA-1 digest is: 07dfce300f6801eb63d9ac13e0bec84e1862a16c\n\nFor OS X Lion Server v10.7.2\nThe download file is named: MacOSXServerUpd10.7.3.dmg\nIts SHA-1 digest is: 55a9571635d4ec088c142d68132d0d69fcb8867d\n\nFor OS X Lion Server v10.7 and v10.7.1\nThe download file is named: MacOSXServerUpdCombo10.7.3.dmg\nIts SHA-1 digest is: 2c87824f09734499ea166ea0617a3ac21ecf832b\n\nFor Mac OS X v10.6.8\nThe download file is named: SecUpd2012-001Snow.dmg\nIts SHA-1 digest is: 40875ee8cb609bbaefc8f421a9c34cc353db42b8\n\nFor Mac OS X Server v10.6.8\nThe download file is named: SecUpdSrvr2012-001.dmg\nIts SHA-1 digest is: 53b3ca5548001a9920aeabed4a034c6e4657fe20\n\nInformation will also be posted to the Apple Security Updates\nweb site: http://support.apple.com/kb/HT1222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG/MacGPG2 v2.0.16 (Darwin)\n\niQEcBAEBAgAGBQJPKYxNAAoJEGnF2JsdZQeeLiIIAMLhH2ipDFrhCsw/n4VDeF1V\nP6jSkGXC9tBBVMvw1Xq4c2ok4SI34bDfMlURAVR+dde/h6nIZR24aLQVoDLjJuIp\nRrO2dm1nQeozLJSx2NbxhVh54BucJdKp4xS1GkDNxkqcdh04RE9hRURXdKagnfGy\n9P8QQPOQmKAiWos/LYhCPDInMfrpVNvEVwP8MCDP15g6hylN4De/Oyt7ZshPshSf\nMnAFObfBTGX5KioVqTyfdlBkKUfdXHJux61QEFHn8eadX6+/6IuKbUvK9B0icc8E\npvbjOxQatFRps0KNWeIsKQc5i6iQoJhocAiIy6Y6LCuZQuSXCImY2RWXkVYzbWo=\n=c1eU\n-----END PGP SIGNATURE-----\n. ----------------------------------------------------------------------\n\n\nJoin Secunia @ FIRST Conference, 12-17 June, Hilton Vienna, Austria\nSee to the presentation \"The Dynamics and Threats of End-Point Software Portfolios\" by Secunia\u0027s Research Analyst Director, Stefan Frei. \nRead more:\nhttp://conference.first.org/ \n\n\n----------------------------------------------------------------------\n\nTITLE:\nApache Subversion mod_dav_svn Two Denial of Service Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA44681\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/44681/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44681\n\nRELEASE DATE:\n2011-06-02\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/44681/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/44681/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44681\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nTwo vulnerabilities have been reported in Apache Subversion, which\ncan be exploited by malicious people to cause a DoS (Denial of\nService). \n\n2) An error within the mod_dav_svn module when handling certain\npath-based access control rules can be exploited to trigger an\ninfinite loop and exhaust memory. \n\nNOTE: A weakness in the handling of path-based access control rules,\nwhich could result in certain unreadable files and directories\nbecoming readable has also been reported. \n\nPROVIDED AND/OR DISCOVERED BY:\n1) Reported by the vendor\n2) The vendor credits Ivan Zhakov, VisualSVN. \n\nORIGINAL ADVISORY:\nhttp://subversion.apache.org/security/CVE-2011-1752-advisory.txt\nhttp://subversion.apache.org/security/CVE-2011-1783-advisory.txt\nhttp://subversion.apache.org/security/CVE-2011-1921-advisory.txt\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/products/corporate/EVM/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 201309-11\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n http://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Low\n Title: Subversion: Multiple vulnerabilities\n Date: September 23, 2013\n Bugs: #350166, #356741, #369065, #463728, #463860, #472202, #482166\n ID: 201309-11\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Subversion, allowing\nattackers to cause a Denial of Service, escalate privileges, or obtain\nsensitive information. \n\nBackground\n==========\n\nSubversion is a versioning system designed to be a replacement for CVS. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 dev-vcs/subversion \u003c 1.7.13 \u003e= 1.7.13\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Subversion. Please\nreview the CVE identifiers referenced below for details. A local attacker could escalate his privileges\nto the user running svnserve. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Subversion users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose \"\u003e=dev-vcs/subversion-1.7.13\"\n\nReferences\n==========\n\n[ 1 ] CVE-2010-4539\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4539\n[ 2 ] CVE-2010-4644\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4644\n[ 3 ] CVE-2011-0715\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0715\n[ 4 ] CVE-2011-1752\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1752\n[ 5 ] CVE-2011-1783\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1783\n[ 6 ] CVE-2011-1921\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1921\n[ 7 ] CVE-2013-1845\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1845\n[ 8 ] CVE-2013-1846\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1846\n[ 9 ] CVE-2013-1847\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1847\n[ 10 ] CVE-2013-1849\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1849\n[ 11 ] CVE-2013-1884\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1884\n[ 12 ] CVE-2013-1968\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1968\n[ 13 ] CVE-2013-2088\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2088\n[ 14 ] CVE-2013-2112\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2112\n[ 15 ] CVE-2013-4131\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4131\n[ 16 ] CVE-2013-4277\n http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4277\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n http://security.gentoo.org/glsa/glsa-201309-11.xml\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2013 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n. The Common Vulnerabilities and Exposures project\nidentifies the following problems:\n\nCVE-2011-1752\n\n The mod_dav_svn Apache HTTPD server module can be crashed though\n when asked to deliver baselined WebDAV resources. \n\nFor the oldstable distribution (lenny), this problem has been fixed in\nversion 1.5.1dfsg1-7. \n\nFor the stable distribution (squeeze), this problem has been fixed in\nversion 1.6.12dfsg-6. \n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 1.6.17dfsg-1. \n\nWe recommend that you upgrade your subversion packages. ==========================================================================\nUbuntu Security Notice USN-1144-1\nJune 06, 2011\n\nsubversion vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 11.04\n- Ubuntu 10.10\n- Ubuntu 10.04 LTS\n\nSummary:\n\nAn attacker could send crafted input to the Subversion mod_dav_svn module\nfor Apache and cause it to crash or gain access to restricted files. \n\nSoftware Description:\n- subversion: Advanced version control system\n\nDetails:\n\nJoe Schaefer discovered that the Subversion mod_dav_svn module for Apache\ndid not properly handle certain baselined WebDAV resource requests. (CVE-2011-1752)\n\nIvan Zhakov discovered that the Subversion mod_dav_svn module for Apache\ndid not properly handle certain requests. (CVE-2011-1921)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 11.04:\n libapache2-svn 1.6.12dfsg-4ubuntu2.1\n\nUbuntu 10.10:\n libapache2-svn 1.6.12dfsg-1ubuntu1.3\n\nUbuntu 10.04 LTS:\n libapache2-svn 1.6.6dfsg-2ubuntu1.3\n\nAfter a standard system update you need to restart any applications that\nuse Subversion, such as Apache when using mod_dav_svn, to make all the\nnecessary changes. \n\nReferences:\n CVE-2011-1752, CVE-2011-1783, CVE-2011-1921\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-4ubuntu2.1\n https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-1ubuntu1.3\n https://launchpad.net/ubuntu/+source/subversion/1.6.6dfsg-2ubuntu1.3\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-1752"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "BID",
"id": "48091"
},
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "PACKETSTORM",
"id": "102004"
},
{
"db": "PACKETSTORM",
"id": "109373"
},
{
"db": "PACKETSTORM",
"id": "101937"
},
{
"db": "PACKETSTORM",
"id": "123358"
},
{
"db": "PACKETSTORM",
"id": "101948"
},
{
"db": "PACKETSTORM",
"id": "102034"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-1752",
"trust": 3.4
},
{
"db": "BID",
"id": "48091",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "44681",
"trust": 2.7
},
{
"db": "SECTRACK",
"id": "1025617",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "44633",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "44879",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "44849",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "44888",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "45162",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "101948",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "102034",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "102004",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "102112",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "102118",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-49697",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "109373",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "101937",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "123358",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "BID",
"id": "48091"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "PACKETSTORM",
"id": "102004"
},
{
"db": "PACKETSTORM",
"id": "109373"
},
{
"db": "PACKETSTORM",
"id": "101937"
},
{
"db": "PACKETSTORM",
"id": "123358"
},
{
"db": "PACKETSTORM",
"id": "101948"
},
{
"db": "PACKETSTORM",
"id": "102034"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"id": "VAR-201106-0131",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-49697"
}
],
"trust": 0.01
},
"last_update_date": "2024-07-23T19:32:07.409000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "subversion-1.6.11-7.AXS3.4",
"trust": 0.8,
"url": "https://tsn.miraclelinux.com/tsn_local/index.php?m=errata\u0026a=detail\u0026eid=1454"
},
{
"title": "2231",
"trust": 0.8,
"url": "https://www.miraclelinux.com/support/index.php?q=node/99\u0026errata_id=2231"
},
{
"title": "RHSA-2011:0861",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2011-0861.html"
},
{
"title": "RHSA-2011:0862",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2011-0862.html"
},
{
"title": "CVE-2011-1752-advisory",
"trust": 0.8,
"url": "http://subversion.apache.org/security/cve-2011-1752-advisory.txt"
},
{
"title": "Subversion 1.6.17 Released",
"trust": 0.8,
"url": "http://svn.haxx.se/dev/archive-2011-06/0030.shtml"
},
{
"title": "Apache Subversion mod_dav_svn Repair measures for null pointer dereference vulnerability",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=129502"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-476",
"trust": 1.1
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://secunia.com/advisories/44681"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/48091"
},
{
"trust": 2.1,
"url": "http://subversion.apache.org/security/cve-2011-1752-advisory.txt"
},
{
"trust": 1.8,
"url": "http://svn.apache.org/repos/asf/subversion/tags/1.6.17/changes"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1025617"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/44633"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/44849"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/44879"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/44888"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/45162"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2012/feb/msg00000.html"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2011/dsa-2251"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-july/062211.html"
},
{
"trust": 1.7,
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-june/061913.html"
},
{
"trust": 1.7,
"url": "http://www.mandriva.com/security/advisories?name=mdvsa-2011:106"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2011-0861.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2011-0862.html"
},
{
"trust": 1.7,
"url": "http://www.ubuntu.com/usn/usn-1144-1"
},
{
"trust": 1.7,
"url": "http://support.apple.com/kb/ht5130"
},
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=709111"
},
{
"trust": 1.7,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a18922"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1752"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-1752"
},
{
"trust": 0.8,
"url": "http://www.securitytracker.com/id/1025617"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1752"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1783"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1921"
},
{
"trust": 0.4,
"url": "http://subversion.apache.org/security/cve-2011-1783-advisory.txt"
},
{
"trust": 0.4,
"url": "http://subversion.apache.org/security/cve-2011-1921-advisory.txt"
},
{
"trust": 0.3,
"url": "http://subversion.apache.org/"
},
{
"trust": 0.3,
"url": "http://support.avaya.com/css/p8/documents/100141174"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1783"
},
{
"trust": 0.1,
"url": "http://store.mandriva.com/product_info.php?cpath=149\u0026amp;products_id=490"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-1921"
},
{
"trust": 0.1,
"url": "http://secunia.com/"
},
{
"trust": 0.1,
"url": "http://www.mandriva.com/security/advisories"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2204"
},
{
"trust": 0.1,
"url": "http://www.php.net"
},
{
"trust": 0.1,
"url": "http://tomcat.apache.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2023"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3252"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1148"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1167"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3182"
},
{
"trust": 0.1,
"url": "http://support.apple.com/kb/ht1222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3249"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0200"
},
{
"trust": 0.1,
"url": "http://trac.roundcube.net/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3256"
},
{
"trust": 0.1,
"url": "http://www.apple.com/support/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4554"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2202"
},
{
"trust": 0.1,
"url": "http://www.freetype.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2895"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0241"
},
{
"trust": 0.1,
"url": "http://www.squirrelmail.org/"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1938"
},
{
"trust": 0.1,
"url": "http://httpd.apache.org/"
},
{
"trust": 0.1,
"url": "http://www.libpng.org/pub/png/libpng.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3250"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2483"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-2813"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-1657"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4555"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3246"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2937"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3248"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-1637"
},
{
"trust": 0.1,
"url": "http://subversion.tigris.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-2192"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-3189"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/evm/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://conference.first.org/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=44681"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44681/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/44681/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1845"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1884"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4539"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1849"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1968"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-0715"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1846"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-2088"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1847"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2112"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4277"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1846"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-2088"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4539"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1849"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-2112"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-0715"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1752"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2010-4644"
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-sa/2.5"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-4131"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1847"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1845"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1968"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-1884"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1921"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2010-4644"
},
{
"trust": 0.1,
"url": "http://security.gentoo.org/glsa/glsa-201309-11.xml"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-4131"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2013-4277"
},
{
"trust": 0.1,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2011-1783"
},
{
"trust": 0.1,
"url": "https://bugs.gentoo.org."
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "http://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-4ubuntu2.1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/subversion/1.6.6dfsg-2ubuntu1.3"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/subversion/1.6.12dfsg-1ubuntu1.3"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "BID",
"id": "48091"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "PACKETSTORM",
"id": "102004"
},
{
"db": "PACKETSTORM",
"id": "109373"
},
{
"db": "PACKETSTORM",
"id": "101937"
},
{
"db": "PACKETSTORM",
"id": "123358"
},
{
"db": "PACKETSTORM",
"id": "101948"
},
{
"db": "PACKETSTORM",
"id": "102034"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-49697"
},
{
"db": "BID",
"id": "48091"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"db": "PACKETSTORM",
"id": "102004"
},
{
"db": "PACKETSTORM",
"id": "109373"
},
{
"db": "PACKETSTORM",
"id": "101937"
},
{
"db": "PACKETSTORM",
"id": "123358"
},
{
"db": "PACKETSTORM",
"id": "101948"
},
{
"db": "PACKETSTORM",
"id": "102034"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-06-06T00:00:00",
"db": "VULHUB",
"id": "VHN-49697"
},
{
"date": "2011-06-02T00:00:00",
"db": "BID",
"id": "48091"
},
{
"date": "2011-06-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"date": "2011-06-04T16:01:34",
"db": "PACKETSTORM",
"id": "102004"
},
{
"date": "2012-02-03T00:24:52",
"db": "PACKETSTORM",
"id": "109373"
},
{
"date": "2011-06-02T05:38:07",
"db": "PACKETSTORM",
"id": "101937"
},
{
"date": "2013-09-23T22:22:00",
"db": "PACKETSTORM",
"id": "123358"
},
{
"date": "2010-06-02T12:12:00",
"db": "PACKETSTORM",
"id": "101948"
},
{
"date": "2011-06-07T01:37:58",
"db": "PACKETSTORM",
"id": "102034"
},
{
"date": "2011-06-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"date": "2011-06-06T19:55:01.550000",
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-10-05T00:00:00",
"db": "VULHUB",
"id": "VHN-49697"
},
{
"date": "2015-05-07T17:04:00",
"db": "BID",
"id": "48091"
},
{
"date": "2011-08-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-001721"
},
{
"date": "2020-10-09T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201106-021"
},
{
"date": "2020-10-05T19:04:39.857000",
"db": "NVD",
"id": "CVE-2011-1752"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "102004"
},
{
"db": "PACKETSTORM",
"id": "102034"
},
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apache Subversion Used in Apache HTTP Server Service disruption in (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-001721"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201106-021"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.