A NULL pointer dereference in moddavlock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.moddavlock is not used internally by moddav or moddavfs.
The only known use-case for moddavlock was moddavsvn from Apache Subversion earlier than version 1.2.0.
Users are recommended to upgrade to version 2.4.66, which fixes this issue, or remove moddavlock.
Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via moddavsvn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed.
All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.
Subversion is not affected on UNIX-like platforms.
AMD. A memory corruption issue was addressed with improved input validation.
AMD. A memory corruption issue was addressed with improved input validation.
Subversion's modauthzsvn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in moddavsvn+modauthzsvn servers 1.14.1 and moddavsvn+modauthzsvn servers 1.10.7
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.
Last updated 25 August 2025
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).
The getresource function in repos.c in the moddavsvn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.
The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.
Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.
A denial of service flaw was found in the way moddavsvn module of Subversion (SVN), a concurrent version control system, used to process certain MOVE, COPY, or DELETE HTTP requests (requests that originated or targeted against a revision root). A remote attacker, with commit access / privileges could use this flaw to cause denial of service (depending on the Apache httpd web server configuration either child assertion failure or crash [prefork MPM configuration] or failure to handle other requests, originally scheduled to be handled within the same thread [threaded MPM configuration] due to a process termination) by issuing a specially-crafted SVN commit request.
Vulnerable package versions: Subversion HTTPD servers 1.7.0 through 1.7.10 (inclusive) Subversion HTTPD servers 1.8.0 (including 1.8.0 release candidates). svnserve (any version) is not vulnerable. Subversion 1.6.x is not vulnerable.
An unintended file contents disclosure flaw was found in the way moddavsvn module of the subversion concurrent version control system processed certain URLs, when path-access control for files and directories was enabled. A remote attacker could use this flaw to obtain information, which should be otherwise prohibited by the authorization subsystem.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Kamesh Jayachandran of CollabNet, Inc. as the original reporter.
An unintended file contents disclosure flaw was found in the way moddavsvn module of the subversion concurrent version control system processed certain URLs, when path-access control for files and directories was enabled. A remote attacker could use this flaw to obtain information, which should be otherwise prohibited by the authorization subsystem.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Kamesh Jayachandran of CollabNet, Inc. as the original reporter.
Multiple memory leaks in revhunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed certain requests to display collection of Subversion repositories, available on particular host, when listing of repositories (SVNListParentPath directive) was enabled. A remote user could use this flaw to cause denial of service (particular httpd thread crash).
References: [1] http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES
Upstream changeset: [2] http://svn.apache.org/viewvc?view=revision&revision=1033166
Public PoC: [3] http://svn.haxx.se/users/archive-2010-11/0084.shtml
Flaw exploitation note: ----------------------- This flaw to be successfully exploited requires the "SVNListParentPath" directive / listing of repositories to be enabled. This feature is turned off by default in versions of subversion package, as shipped with Red Hat Enterprise Linux 5 and 6, which prevents occurrence / exploitation of this flaw.
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed certain requests to display collection of Subversion repositories, available on particular host, when listing of repositories (SVNListParentPath directive) was enabled. A remote user could use this flaw to cause denial of service (particular httpd thread crash).
References: [1] http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES
Upstream changeset: [2] http://svn.apache.org/viewvc?view=revision&revision=1033166
Public PoC: [3] http://svn.haxx.se/users/archive-2010-11/0084.shtml
Flaw exploitation note: ----------------------- This flaw to be successfully exploited requires the "SVNListParentPath" directive / listing of repositories to be enabled. This feature is turned off by default in versions of subversion package, as shipped with Red Hat Enterprise Linux 5 and 6, which prevents occurrence / exploitation of this flaw.
Multiple integer overflows in the libsvndelta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.
Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier, and other products that use neon including (2) Cadaver, (3) Subversion, and (4) OpenOffice, allow remote malicious WebDAV servers to execute arbitrary code.