Multiple integer overflows in the libsvndelta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.

Multiple memory leaks in revhunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.

A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed certain requests to display collection of Subversion repositories, available on particular host, when listing of repositories (SVNListParentPath directive) was enabled. A remote user could use this flaw to cause denial of service (particular httpd thread crash).

References: [1] http://svn.apache.org/repos/asf/subversion/tags/1.6.15/CHANGES

Upstream changeset: [2] http://svn.apache.org/viewvc?view=revision&revision=1033166

Public PoC: [3] http://svn.haxx.se/users/archive-2010-11/0084.shtml

Flaw exploitation note: ----------------------- This flaw to be successfully exploited requires the "SVNListParentPath" directive / listing of repositories to be enabled. This feature is turned off by default in versions of subversion package, as shipped with Red Hat Enterprise Linux 5 and 6, which prevents occurrence / exploitation of this flaw.

An unintended file contents disclosure flaw was found in the way moddavsvn module of the subversion concurrent version control system processed certain URLs, when path-access control for files and directories was enabled. A remote attacker could use this flaw to obtain information, which should be otherwise prohibited by the authorization subsystem.

Acknowledgements:

Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Kamesh Jayachandran of CollabNet, Inc. as the original reporter.