CVE-2011-0715: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed requests to lock working copy paths in the repository, when particular Subversion client, requesting the lock, was not previously authenticated to the Subversion server. A remote attacker could use this flaw to cause a denial of service (crash of particular httpd thread, serving the request).
Acknowledgements:
Red Hat would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.
Other sources
The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0715?
CVE-2011-0715 has a high severity rating due to its potential to allow remote attackers to cause a denial of service.
How do I fix CVE-2011-0715?
To fix CVE-2011-0715, upgrade to a patched version of Apache Subversion that is above 1.6.15.
What software is affected by CVE-2011-0715?
CVE-2011-0715 affects various versions of Apache Subversion, specifically those prior to version 1.6.16.
What type of vulnerability is CVE-2011-0715?
CVE-2011-0715 is classified as a NULL pointer dereference vulnerability.
Can CVE-2011-0715 be exploited remotely?
Yes, CVE-2011-0715 can be exploited remotely by unauthenticated attackers to trigger a denial of service.