PatchTheCVEsubversion vulnerabilities
Recent CVEs affecting subversion products. 7 tracked.
subversion has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2009-08-07. Highest priority: CVE-2004-0413 (score 58/100).
- CVE-2009-2411 HIGH 8.5 UPGRADE Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, all
- CVE-2007-3846 MEDIUM 6.0 UPGRADE UPGRADE Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly
- CVE-2007-2448 LOW 2.1 UPGRADE Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have acc
- CVE-2004-1438 LOW 2.1 DOWNGRADE The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with wr
- CVE-2004-0749 MEDIUM 5.0 DOWNGRADE MITIGATE The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on
- CVE-2004-0413 HIGH 10.0 DOWNGRADE DOWNGRADE libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn pro
- CVE-2004-0397 HIGH 7.5 DOWNGRADE Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remot
FAQ
How do I fix subversion vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is subversion being exploited right now?
None of the tracked subversion CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which subversion CVE should I patch first?
CVE-2004-0413 currently ranks highest (58/100): libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn pro.