https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Apache Subversion 1.7.15 |VUL-1: Apache Subversion |fixes remotely triggerable |1.7.15 fixes remotely |segmentation fault in |triggerable segmentation |mod_dav_svn |fault in mod_dav_svn Alias| |CVE-2014-0032 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c2 Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Security |Security AssignedTo|Andreas.Stieger@gmx.de |security-team@suse.de Product|openSUSE 12.3 |openSUSE 13.1 Target Milestone|--- |Final Summary|VUL-1: CVE-2014-0032: |VUL-1: CVE-2014-0032: |Apache Subversion 1.7.15 |Apache Subversion 1.7.15 |fixes remotely triggerable |and 1.8.6 fix remotely |segmentation fault in |triggerable segmentation |mod_dav_svn |fault in mod_dav_svn --- Comment #2 from Andreas Stieger 2014-02-06 19:17:20 UTC --- from http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES Version 1.8.6 (12 Feb 2014, from /branches/1.8.x) http://svn.apache.org/repos/asf/subversion/tags/1.8.6 User-visible changes: - Client-side bugfixes: * use CryptoAPI to validate intermediary certificates on Windows (r1564623) * fix automatic relocate for wcs not at repository root (r1541638 et al) * diff: fix when target is a drive root on Windows (r1541635) * wc: improve performance when used with SQLite 3.8 (r1542765) * copy: fix some scenarios that broke the working copy (r1560690) * move: fix errors when moving files between an external and the parent working copy (r1551524, r1551579) * log: resolve performance regression in certain scenarios (r1553101 et al) * merge: decrease work to detect differences between 3 files (r1548486) * checkout: don't require flush support for symlinks on Windows (r1547774) * commit: don't change file permissions inappropriately (issue #4440) * commit: fix assertion due to invalid pool lifetime (r1553376 et al) * version: don't cut off the distribution version on Linux (r1544878 et al) * flush stdout before exiting to avoid information being lost (r1499470) * status: fix missing sentinel value on warning codes (r1543145) - Server-side bugfixes: * reduce memory usage during checkout and export (r1564215) * fsfs: create rep-cache.db with proper permissions (issue #3437) * mod_dav_svn: prevent crashes with SVNListParentPath on (CVE-2014-0032) * mod_dav_svn: fix SVNAllowBulkUpdates directive merging (r1548105) * mod_dav_svn: include requested property changes in reports (r1557522) * svnserve: correct default cache size in help text (r1563110) * svnadmin dump: reduce size of dump files with '--deltas' (r1554978) Developer-visible changes: - API changes: * numerous documentation fixes * svn_client_commit_item3_dup() fix pool lifetime issues (r1550803) * ra_serf: properly ask multiple certificate validation providers for acceptance of certificate failures (r1535532) * release internal fs objects when closing commit editor (r1555499) * svn_client_proplist4() don't call the callback multiple times for the same path in order to deliver inherited properties (r1549858 et al) - Bindings: * javahl: make test suite run without installing on OS X (r1535115) * swig: fix building out of tarball on OS X (r1555654) * swig-pl: fix with --enable-sqlite-compatibility-version (r1559009) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c5 --- Comment #5 from Andreas Stieger 2014-02-09 23:22:56 UTC --- Maintenance request for 13.1: https://build.opensuse.org/request/show/221558 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c6 Andreas Stieger changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |security-team@suse.de Summary|VUL-1: CVE-2014-0032: |VUL-1: |Apache Subversion 1.7.15 |CVE-2014-0032:remotely |and 1.8.6 fix remotely |triggerable segmentation |triggerable segmentation |fault in mod_dav_svn |fault in mod_dav_svn | --- Comment #6 from Andreas Stieger 2014-02-14 19:28:41 UTC --- The releases are delayed due to other regressions. Instead, the fix was patched in. 13.1 update already running, maintenance request for 12.3: https://build.opensuse.org/request/show/222394 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c7 SMASH SMASH changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|obs:running:2557:moderate |obs:running:2557:moderate |obs:running:2584:moderate |obs:running:2584:moderate | |maint:planned:update --- Comment #7 from SMASH SMASH 2014-02-20 09:25:12 UTC --- Affected packages: SLE-11-SP3: subversion SLE-10-SP3-TERADATA: subversion SLE-11-SP2: subversion -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|VUL-1: |VUL-1: CVE-2014-0032: |CVE-2014-0032:remotely |subversion: remotely |triggerable segmentation |triggerable segmentation |fault in mod_dav_svn |fault in mod_dav_svn -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c9 --- Comment #9 from Bernhard Wiedemann 2014-02-26 20:00:12 CET --- This is an autogenerated message for OBS integration: This bug (862459) was mentioned in https://build.opensuse.org/request/show/223995 12.3 / subversion -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c11 --- Comment #11 from Andreas Stieger 2014-02-27 13:04:11 UTC --- (In reply to comment #10)

Dirk is internal subversion maintainer, reassign for affectedness clarification.

This may be helpful: https://subversion.apache.org/security/CVE-2014-0032-advisory.txt

Known vulnerable: =================

Subversion HTTPD servers 1.3.0 through 1.7.14 (inclusive) Subversion HTTPD servers 1.8.0 through 1.8.5 (inclusive)

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c12 --- Comment #12 from Swamp Workflow Management 2014-02-28 10:04:38 UTC --- openSUSE-SU-2014:0307-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 862459 CVE References: CVE-2014-0032 Sources used: openSUSE 13.1 (src): subversion-1.8.8-2.21.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c15 --- Comment #15 from Swamp Workflow Management 2014-03-06 14:04:35 UTC --- openSUSE-SU-2014:0334-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 862459 CVE References: CVE-2014-0032 Sources used: openSUSE 12.3 (src): subversion-1.7.16-2.28.1 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c28 --- Comment #28 from Petr Gajdos 2014-03-28 10:16:26 UTC --- For sles12 used original patch referenced in comment 20. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c34 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| | |maint:running:56328:moderat |maint:running:56328:moderat |e |e |maint:released:sle11-sp2:56 |maint:released:sle11-sp3:56 |347 |348 --- Comment #34 from Swamp Workflow Management 2014-04-17 01:47:23 UTC --- Update released for: subversion, subversion-debuginfo, subversion-debugsource, subversion-devel, subversion-perl, subversion-python, subversion-server, subversion-tools Products: SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64) SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=862459 https://bugzilla.novell.com/show_bug.cgi?id=862459#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| | |maint:running:56328:moderat |maint:released:sle11-sp3:56 |e |348 |maint:released:sle11-sp3:56 | |348 | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.