Apache » Subversion : Security Vulnerabilities, CVEs, (Memory corruption)
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
Max CVSS
7.5
EPSS Score
0.14%
Published
2022-04-12
Updated
2022-10-28
The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.
Max CVSS
6.5
EPSS Score
8.44%
Published
2016-05-05
Updated
2020-10-20
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.
Max CVSS
5.0
EPSS Score
1.29%
Published
2014-12-18
Updated
2017-01-03
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.
Max CVSS
5.0
EPSS Score
1.68%
Published
2014-12-18
Updated
2016-12-24
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
Max CVSS
5.0
EPSS Score
6.39%
Published
2013-05-02
Updated
2017-09-19
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
Max CVSS
4.3
EPSS Score
1.26%
Published
2013-05-02
Updated
2017-09-19
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
Max CVSS
5.0
EPSS Score
10.98%
Published
2013-05-02
Updated
2017-09-19
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
Max CVSS
4.0
EPSS Score
0.39%
Published
2013-05-02
Updated
2018-10-30
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.
Max CVSS
5.0
EPSS Score
0.72%
Published
2011-06-06
Updated
2020-10-05
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
Max CVSS
4.3
EPSS Score
1.26%
Published
2011-03-11
Updated
2017-09-19
The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.
Max CVSS
6.8
EPSS Score
0.55%
Published
2011-01-07
Updated
2023-02-13
11 vulnerabilities found