CVE-2016-2168: Null Pointer Dereference
The reqcheckaccess function in the modauthzsvn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2168?
CVE-2016-2168 has a moderate severity level due to the potential for a denial of service.
How do I fix CVE-2016-2168?
To fix CVE-2016-2168, you should update your Apache Subversion to version 1.8.16 or later or 1.9.4 or later.
What impact does CVE-2016-2168 have on my system?
CVE-2016-2168 can cause a denial of service by crashing the server due to a NULL pointer dereference.
Who is affected by CVE-2016-2168?
Users of Apache Subversion versions prior to 1.8.16 and all 1.9.x versions before 1.9.4 are affected by CVE-2016-2168.
What types of requests can trigger CVE-2016-2168?
CVE-2016-2168 can be triggered by crafted header information in MOVE or COPY requests.