https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |ASSIGNED AssignedTo|bnc-team-screening@forge.pr |Andreas.Stieger@gmx.de |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Maintenance |Security AssignedTo|Andreas.Stieger@gmx.de |security-team@suse.de Severity|Critical |Normal -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c2 --- Comment #2 from Andreas Stieger 2013-08-30 15:53:19 UTC --- 1.7.13: CVE-2013-4246: svnserve: symlink attack against pid file -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c4 --- Comment #4 from Andreas Stieger 2013-08-30 16:05:42 UTC --- (In reply to comment #2)

1.7.13: CVE-2013-4246: svnserve: symlink attack against pid file

Mistake from upstream. This is actually: CVE-2013-4277: svnserve: symlink attack against pid file https://build.opensuse.org/request/show/196923 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c5 Alexander Bergmann changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |abergmann@suse.com --- Comment #5 from Alexander Bergmann 2013-09-03 15:59:04 UTC --- SLE11 SP2/3 is also effected by this. SLE10 SP4 is not effected. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c7 Alexander Bergmann changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |Andreas.Stieger@gmx.de AssignedTo|Andreas.Stieger@gmx.de |mvyskocil@suse.com Summary|Apache Subversion |VUL-1: CVE-2013-4277: |maintenance release 1.7.13 |subversion: Apache | |Subversion maintenance | |release 1.7.13 Alias| |CVE-2013-4277 --- Comment #7 from Alexander Bergmann 2013-09-03 16:04:41 UTC --- In SLE11 the effected file is subversion/svnserve/main.c. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c9 --- Comment #9 from Alexander Bergmann 2013-09-04 14:04:01 UTC --- Thanks Andreas! It looks like we didn't get any pre-notification for this issue. The easiest way would be a heads-up to security@suse.de. It's even possible to use GPG (Key ID: 3D25D3D9). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c11 Michal Vyskocil changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|mvyskocil@suse.com |security-team@suse.de --- Comment #11 from Michal Vyskocil 2013-09-12 07:20:09 UTC --- I've backported the fix for subversion 1.6 - sent as 28742 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c13 --- Comment #13 from Swamp Workflow Management 2013-09-13 08:08:08 UTC --- openSUSE-SU-2013:1442-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 836245 CVE References: CVE-2013-4277 Sources used: openSUSE 12.3 (src): subversion-1.7.13-2.16.1 openSUSE 12.2 (src): subversion-1.7.13-4.24.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=836245 https://bugzilla.novell.com/show_bug.cgi?id=836245#c15 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:54537:importa | |nt --- Comment #15 from Swamp Workflow Management 2013-09-26 16:55:22 UTC --- The SWAMPID for this issue is 54537. This issue was rated as important. Please submit fixed packages until 2013-10-03. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.