Fedora: 2,1: subversion Buffer overflow vulnerability
Summary
Subversion is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a
hierarchy of files and directories while keeping a history of all
changes. Subversion only stores the differences between versions,
instead of every complete file. Subversion is intended to be a
compelling replacement for CVS.
Subversion is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a
hierarchy of files and directories while keeping a history of all
changes. Subversion only stores the differences between versions,
instead of every complete file. Subversion is intended to be a
compelling replacement for CVS.
Update Information:
Stefan Esser discovered an issue in the date parsing routines in
Subversion which allows a buffer overflow. An attacker could send
malicious requests to a Subversion server (either Apache-based using
mod_dav_svn, or using the svnserve daemon) and perform arbitrary
execution of code.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0397 to this issue. This update includes
packages with a patch for this issue.
* Sat May 15 2004 Joe Orton <jorton@redhat.com> 1.0.2-2.1
- add security fix for CVE CAN-2004-0397 (Ben Reser)
* Tue May 04 2004 Joe Orton <jorton@redhat.com> 1.0.2-2
- add perl MODULE_COMPAT requirement for -perl subpackage
- move perl man pages into -perl subpackage
- clean up -perl installation and dependencies (Ville Skyttä, #123045)
This update can be downloaded from:
92cc070981eae85dc2220126a7cbd9d0 SRPMS/subversion-1.0.2-2.1.src.rpm
2ff7ecbf8f8c10b6ab761c3cbc913bf2 i386/subversion-1.0.2-2.1.i386.rpm
a9e16d37859ee2168af5d2f0e53560a5 i386/subversion-devel-1.0.2-2.1.i386.rpm
6bd4b498f5c13bf4d2b2ad6668c86008 i386/mod_dav_svn-1.0.2-2.1.i386.rpm
bfbbc9af5bbc287f74260bacb3bd3126 i386/subversion-perl-1.0.2-2.1.i386.rpm
8d4671361745f71e67310007ef8c6449 i386/debug/subversion-debuginfo-1.0.2-2.1.i386.rpm
ca4fddfff4fff8a5496e29f3c314d32f x86_64/subversion-1.0.2-2.1.x86_64.rpm
0af6c873bcffd22fb0e1e4d60bcf1813 x86_64/subversion-devel-1.0.2-2.1.x86_64.rpm
9f8cef2892d8929b76f61562850e0648 x86_64/mod_dav_svn-1.0.2-2.1.x86_64.rpm
3e0bdc13b5fcd141416ec102b8608ac7 x86_64/subversion-perl-1.0.2-2.1.x86_64.rpm
f7d2a0c88fcaeba74ef0bc9c9cb97dc9 x86_64/debug/subversion-debuginfo-1.0.2-2.1.x86_64.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Fedora Update Notification
FEDORA-2004-127
2004-05-19
Product : Fedora Core 1
Name : subversion
Version : 0.32.1
Release : 2
Summary : A Concurrent Versioning system similar to, but better than, CVS.
Description :
Subversion is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a
hierarchy of files and directories while keeping a history of all
changes. Subversion only stores the differences between versions,
instead of every complete file. Subversion is intended to be a
compelling replacement for CVS.
Stefan Esser discovered an issue in the date parsing routines in
Subversion which allows a buffer overflow. An attacker could send
malicious requests to a Subversion server (either Apache-based using
mod_dav_svn, or using the svnserve daemon) and perform arbitrary
execution of code.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0397 to this issue. This update includes
packages with a patch for this issue.
* Wed May 12 2004 Joe Orton <jorton@redhat.com> 0.32.1-2
- add security fix for CVE CAN-2004-0397 (Ben Reser)
This update can be downloaded from:
21f86e755d58ec2ca68c2dc338e26743 SRPMS/subversion-0.32.1-2.src.rpm
e844f7f47bdae053bfe94d4b0fd2ee16 i386/subversion-0.32.1-2.i386.rpm
18413a741fb6a6ffac48b3765bb0dd6d i386/subversion-devel-0.32.1-2.i386.rpm
8565cf933e01213c9cfd741e66fb49d9 i386/mod_dav_svn-0.32.1-2.i386.rpm
04be62fe37bf0a0af958f4dba83dc717 i386/debug/subversion-debuginfo-0.32.1-2.i386.rpm
fc9cec597b0ac29f8af2311059c0325a x86_64/subversion-0.32.1-2.x86_64.rpm
69617e64446f47824698ffd94cb3f01b x86_64/subversion-devel-0.32.1-2.x86_64.rpm
903b1f372340c0099ee7876175b3dc23 x86_64/mod_dav_svn-0.32.1-2.x86_64.rpm
0f4755e17c255b54dfdd9c9982d52910 x86_64/debug/subversion-debuginfo-0.32.1-2.x86_64.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
Change Log
References
Fedora Update Notification FEDORA-2004-128 2004-05-19 Product : Fedora Core 2 Name : subversion Version : 1.0.2 Release : 2.1 Summary : Modern Version Control System designed to replace CVS Description : Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. Subversion only stores the differences between versions, instead of every complete file. Subversion is intended to be a compelling replacement for CVS.