subversion (1.6.17dfsg-3ubuntu3.4) precise-security; urgency=medium
* SECURITY UPDATE: denial of service via mod_dav_svn
- debian/patches/CVE-2014-0032.patch: only allow GET and HEAD in
subversion/mod_dav_svn/repos.c.
- CVE-2014-0032
* SECURITY UPDATE: incorrect ssl cert validation
- debian/patches/CVE-2014-3522.patch: properly validate hostnames in
subversion/include/private/svn_cert.h,
subversion/libsvn_ra_serf/util.c,
subversion/libsvn_subr/dirent_uri.c,
added tests to subversion/tests/libsvn_subr/dirent_uri-test.c.
- CVE-2014-3522
* SECURITY UPDATE: md5 collision authentication leak
- debian/patches/CVE-2014-3528.patch: check if realm matches in
subversion/libsvn_subr/config_auth.c.
- CVE-2014-3528
Date: 2014-08-13 20:32:12.754052+00:00
Changed-By: Marc Deslauriers <[email protected]>
Signed-By: Ubuntu Archive Robot
<[email protected]>
https://launchpad.net/ubuntu/precise/+source/subversion/1.6.17dfsg-3ubuntu3.4
Sorry, changesfile not available.
--
Precise-changes mailing list
[email protected]
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/precise-changes
