Mailinglist Archive: opensuse-updates (102 mails)

[opensuse-security@xxxxxxxxxxxx]

   openSUSE Security Update: subversion to 1.7.16 to fix mod_dav_svn crash
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2014:0334-1
Rating:             moderate
References:         #862459 
Cross-References:   CVE-2014-0032
Affected Products:
                    openSUSE 12.3
______________________________________________________________________________

   An update that fixes one vulnerability is now available.

Description:


   Apache Subversion was updated to 1.7.16 [bnc#862459] This
   release addresses one security issue: CVE-2014-0032:
   mod_dav_svn DoS vulnerability with SVNListParentPath.
   Affects servers with mod_dav_svn when configured on the
   root path of the server and SVNListParentPath is on.

   - Client-side bugfixes:
   * copy: fix some scenarios that broke the working copy
   * diff: fix regressions due to fixes in 1.7.14
   - Server-side bugfixes:
   * mod_dav_svn: prevent crashes with SVNListParentPath on
   (CVE-2014-0032)
   * reduce memory usage during checkout and export
   Developer-visible changes:
   * fix failure in checkout_tests.py
   * support compiling against Cyrus sasl 2.1.25
   * support compiling against neon 0.30.x
   - modified patches:
   * subversion-no-build-date.patch for context changes
   - 1.7.15 was not released
   - only require and build with junit when building with java
   and running regression tests


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 12.3:

      zypper in -t patch openSUSE-2014-186

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 12.3 (i586 x86_64):

      libsvn_auth_gnome_keyring-1-0-1.7.16-2.28.1
      libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.16-2.28.1
      libsvn_auth_kwallet-1-0-1.7.16-2.28.1
      libsvn_auth_kwallet-1-0-debuginfo-1.7.16-2.28.1
      subversion-1.7.16-2.28.1
      subversion-debuginfo-1.7.16-2.28.1
      subversion-debugsource-1.7.16-2.28.1
      subversion-devel-1.7.16-2.28.1
      subversion-perl-1.7.16-2.28.1
      subversion-perl-debuginfo-1.7.16-2.28.1
      subversion-python-1.7.16-2.28.1
      subversion-python-debuginfo-1.7.16-2.28.1
      subversion-server-1.7.16-2.28.1
      subversion-server-debuginfo-1.7.16-2.28.1
      subversion-tools-1.7.16-2.28.1
      subversion-tools-debuginfo-1.7.16-2.28.1

   - openSUSE 12.3 (noarch):

      subversion-bash-completion-1.7.16-2.28.1


References:

   http://support.novell.com/security/cve/CVE-2014-0032.html
   https://bugzilla.novell.com/862459