CVE-2014-8108: Null Pointer Dereference

Published Dec 18, 2014

Updated

The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

Affected Software

96 affected components

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Workstation=7.0

Apache subversion=1.0.0

Apache subversion=1.0.1

Apache subversion=1.0.2

Apache subversion=1.0.3

Apache subversion=1.0.4

Apache subversion=1.0.5

Apache subversion=1.0.6

Apache subversion=1.0.7

Apache subversion=1.0.8

Apache subversion=1.0.9

Apache subversion=1.1.0

Apache subversion=1.1.1

Apache subversion=1.1.2

Apache subversion=1.1.3

Apache subversion=1.1.4

Apache subversion=1.2.0

Apache subversion=1.2.1

Apache subversion=1.2.2

Apache subversion=1.2.3

Apache subversion=1.3.0

Apache subversion=1.3.1

Apache subversion=1.3.2

Apache subversion=1.4.0

Apache subversion=1.4.1

Apache subversion=1.4.2

Apache subversion=1.4.3

Apache subversion=1.4.4

Apache subversion=1.4.5

Apache subversion=1.4.6

Apache subversion=1.5.0

Apache subversion=1.5.1

Apache subversion=1.5.2

Apache subversion=1.5.3

Apache subversion=1.5.4

Apache subversion=1.5.5

Apache subversion=1.5.6

Apache subversion=1.5.7

Apache subversion=1.5.8

Apache subversion=1.6.0

Apache subversion=1.6.1

Apache subversion=1.6.2

Apache subversion=1.6.3

Apache subversion=1.6.4

Apache subversion=1.6.5

Apache subversion=1.6.6

Apache subversion=1.6.7

Apache subversion=1.6.8

Apache subversion=1.6.9

Apache subversion=1.6.10

Apache subversion=1.6.11

Apache subversion=1.6.12

Apache subversion=1.6.13

Apache subversion=1.6.14

Apache subversion=1.6.15

Apache subversion=1.6.16

Apache subversion=1.6.17

Apache subversion=1.6.18

Apache subversion=1.6.19

Apache subversion=1.6.20

Apache subversion=1.6.21

Apache subversion=1.6.23

Apache subversion=1.7.0

Apache subversion=1.7.1

Apache subversion=1.7.2

Apache subversion=1.7.3

Apache subversion=1.7.4

Apache subversion=1.7.5

Apache subversion=1.7.6

Apache subversion=1.7.7

Apache subversion=1.7.8

Apache subversion=1.7.9

Apache subversion=1.7.10

Apache subversion=1.7.11

Apache subversion=1.7.12

Apache subversion=1.7.13

Apache subversion=1.7.14

Apache subversion=1.7.15

Apache subversion=1.7.16

Apache subversion=1.7.17

Apache subversion=1.7.18

Apache subversion=1.7.19

Apache subversion=1.8.0

Apache subversion=1.8.1

Apache subversion=1.8.2

Apache subversion=1.8.3

Apache subversion=1.8.4

Apache subversion=1.8.5

Apache subversion=1.8.6

Apache subversion=1.8.7

Apache subversion=1.8.8

Apache subversion=1.8.10

Apple Xcode=6.1.1

Remediation

Patch Available

http://subversion.apache.org/security/CVE-2014-8108-advisory.txt

Event History

Dec 18, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8108?

CVE-2014-8108 has a severity rating classified as moderate due to the potential for denial of service.

How do I fix CVE-2014-8108?

To fix CVE-2014-8108, upgrade Apache Subversion to version 1.7.19 or 1.8.11 or later.

What systems are affected by CVE-2014-8108?

CVE-2014-8108 affects specific versions of Apache Subversion from 1.7.x before 1.7.19 and 1.8.x before 1.8.11.

What kind of attack does CVE-2014-8108 enable?

CVE-2014-8108 enables remote attackers to conduct a denial-of-service attack through a null pointer dereference.

When was CVE-2014-8108 discovered?

CVE-2014-8108 was discovered in 2014 and addressed in subsequent Apache Subversion updates.