—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:192
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : subversion
Date : April 3, 2015
Affected: Business Server 1.0, Business Server 2.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in
subversion:

Subversion HTTP servers with FSFS repositories are vulnerable to a
remotely triggerable excessive memory use with certain REPORT requests
(CVE-2015-0202).

Subversion mod_dav_svn and svnserve are vulnerable to a remotely
triggerable assertion DoS vulnerability for certain requests with
dynamically evaluated revision numbers (CVE-2015-0248).

Subversion HTTP servers allow spoofing svn:author property values
for new revisions (CVE-2015-0251).

The updated packages have been upgraded to the 1.7.20 and 1.8.13
versions where these security flaws has been fixed.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0248
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251
http://subversion.apache.org/security/CVE-2015-0202-advisory.txt
http://subversion.apache.org/security/CVE-2015-0248-advisory.txt
http://subversion.apache.org/security/CVE-2015-0251-advisory.txt
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
431997d6c51445e6dfd80aa257d71cde mbs1/x86_64/apache-mod_dav_svn-1.7.20-1.mbs1.x86_64.rpm
be7ff8ab86b7d249c90e681ff94d7e5c mbs1/x86_64/lib64svn0-1.7.20-1.mbs1.x86_64.rpm
666178703664d199455b8a67e1f2e8d7 mbs1/x86_64/lib64svn-gnome-keyring0-1.7.20-1.mbs1.x86_64.rpm
3ce5845f3f36d40f4b61803ab22baad0 mbs1/x86_64/lib64svnjavahl1-1.7.20-1.mbs1.x86_64.rpm
adaf02401908f768d1a5ed1fae2a2845 mbs1/x86_64/perl-SVN-1.7.20-1.mbs1.x86_64.rpm
02c85a550542afc0ab22c05ccfe0a569 mbs1/x86_64/perl-svn-devel-1.7.20-1.mbs1.x86_64.rpm
a6b4145e35dcf218b2aaf9dfec09a071 mbs1/x86_64/python-svn-1.7.20-1.mbs1.x86_64.rpm
9efccfc610ce975e3fa056d0a96479ac mbs1/x86_64/python-svn-devel-1.7.20-1.mbs1.x86_64.rpm
5a7f2f8e3f82896a0336904b448b8e09 mbs1/x86_64/ruby-svn-1.7.20-1.mbs1.x86_64.rpm
99001923a24600d2e5f9d41a852d226a mbs1/x86_64/ruby-svn-devel-1.7.20-1.mbs1.x86_64.rpm
6ff89286c065648f4004941dcad80b7c mbs1/x86_64/subversion-1.7.20-1.mbs1.x86_64.rpm
7378f77b345dbdcb007ca85507fdf7f5 mbs1/x86_64/subversion-devel-1.7.20-1.mbs1.x86_64.rpm
d1c035d3757ab042971d47c8d8c1a936 mbs1/x86_64/subversion-doc-1.7.20-1.mbs1.x86_64.rpm
0dae2994b65b1795239d1d755e1ad853 mbs1/x86_64/subversion-gnome-keyring-devel-1.7.20-1.mbs1.x86_64.rpm
8a52bff9e69570d1444e289922712885 mbs1/x86_64/subversion-server-1.7.20-1.mbs1.x86_64.rpm
a13c7bc82cca7e21f3f709070c649fdd mbs1/x86_64/subversion-tools-1.7.20-1.mbs1.x86_64.rpm
ee3d0af44b559c0fcdc39899ed468722 mbs1/x86_64/svn-javahl-1.7.20-1.mbs1.x86_64.rpm
d35a59dacee19678345bca7f62a9dc43 mbs1/SRPMS/subversion-1.7.20-1.mbs1.src.rpm

Mandriva Business Server 2/X86_64:
d119276a0b0f79ea80ce07c3a4fbdd61 mbs2/x86_64/apache-mod_dav_svn-1.8.13-1.mbs2.x86_64.rpm
9b95df70751f4cd576df2c821bb8a252 mbs2/x86_64/lib64svn0-1.8.13-1.mbs2.x86_64.rpm
97ad4790a185fe6be5f03a70b87ba6eb mbs2/x86_64/lib64svnjavahl1-1.8.13-1.mbs2.x86_64.rpm
3c877e6474855c2f7d356136feed637d mbs2/x86_64/perl-SVN-1.8.13-1.mbs2.x86_64.rpm
3a7acd54b71f1b879a0df49918c52dac mbs2/x86_64/perl-svn-devel-1.8.13-1.mbs2.x86_64.rpm
85fb6b75c0e7353fa12ca07aae7ef0ec mbs2/x86_64/python-svn-1.8.13-1.mbs2.x86_64.rpm
4f49f899bd6c44fa463a5de888dc0d1f mbs2/x86_64/python-svn-devel-1.8.13-1.mbs2.x86_64.rpm
bf8bc3693c401dc104f7d70485c85592 mbs2/x86_64/ruby-svn-1.8.13-1.mbs2.x86_64.rpm
d777cc96f096a284252f037714c59e21 mbs2/x86_64/ruby-svn-devel-1.8.13-1.mbs2.x86_64.rpm
84a949f8d941f9be6f5ad893fa2d07c9 mbs2/x86_64/subversion-1.8.13-1.mbs2.x86_64.rpm
ff2ca998dcb48d1ebb6fd90bf54bdd41 mbs2/x86_64/subversion-devel-1.8.13-1.mbs2.x86_64.rpm
1bac588bd8d69888390ac58c0482e069 mbs2/x86_64/subversion-doc-1.8.13-1.mbs2.x86_64.rpm
2567c1dca210921e8c91702298c6b55e mbs2/x86_64/subversion-server-1.8.13-1.mbs2.x86_64.rpm
64eda374400f18c1ea39e9a6c7c8de86 mbs2/x86_64/subversion-tools-1.8.13-1.mbs2.x86_64.rpm
6c7f82ee4ddf71bb8d00c9e480b53954 mbs2/x86_64/svn-javahl-1.8.13-1.mbs2.x86_64.rpm
792c55ba6ff05a62eba107cecf81ab1f mbs2/SRPMS/subversion-1.8.13-1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVHi4DmqjQ0CJFipgRAq4PAJ4rT78F0pjFUsLAj5g2LyW/i7FzjACghsR2
8qy1ijw1LXYodmRPbqqvZOY=
=Y/G0
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________