CVE-2015-5343
HighSummary
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.
Risk Assessment
The organization may experience server crashes and increased memory consumption, leading to service availability interruptions. There is also a risk of arbitrary code execution, which could compromise system security.
Recommendation
It is recommended to update Apache Subversion to version 1.8.15 or 1.9.3 or later to mitigate this vulnerability. Additionally, monitoring server logs for potential exploitation attempts is advisable.
Other vulnerabilities in Apache Subversion
See all- CVE-2013-4246High
In Apache Subversion 1.8.x before version 1.8.2, a vulnerability exists that may allow remote authenticated users with commit access to corrupt FSFS repositories and cause denial of service or obtain sensitive information by editing packed revision properties.
- CVE-2015-5259High
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Original NVD description (English source)
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.