Security update for subversion SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0709-1 Final 1 1 2014-08-19T23:56:28Z current 2014-08-19T23:56:28Z 2014-08-19T23:56:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for subversion Subversion has been updated to fix a security problem: * bnc#889849: Reveal authentication information through an md5 collision attack on authentication realm (CVE-2014-3528) Security Issues: * CVE-2014-3528 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-subversion,slestso13-subversion Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ Link for SUSE-SU-2015:0709-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001347.html E-Mail link for SUSE-SU-2015:0709-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/813913 SUSE Bug 813913 https://bugzilla.suse.com/821505 SUSE Bug 821505 https://bugzilla.suse.com/834014 SUSE Bug 834014 https://bugzilla.suse.com/836245 SUSE Bug 836245 https://bugzilla.suse.com/841205 SUSE Bug 841205 https://bugzilla.suse.com/850667 SUSE Bug 850667 https://bugzilla.suse.com/862459 SUSE Bug 862459 https://bugzilla.suse.com/889849 SUSE Bug 889849 https://bugzilla.suse.com/909935 SUSE Bug 909935 https://bugzilla.suse.com/910376 SUSE Bug 910376 https://bugzilla.suse.com/923794 SUSE Bug 923794 https://bugzilla.suse.com/923795 SUSE Bug 923795 https://www.suse.com/security/cve/CVE-2013-1845/ SUSE CVE CVE-2013-1845 page https://www.suse.com/security/cve/CVE-2013-1846/ SUSE CVE CVE-2013-1846 page https://www.suse.com/security/cve/CVE-2013-1847/ SUSE CVE CVE-2013-1847 page https://www.suse.com/security/cve/CVE-2013-1849/ SUSE CVE CVE-2013-1849 page https://www.suse.com/security/cve/CVE-2013-1884/ SUSE CVE CVE-2013-1884 page https://www.suse.com/security/cve/CVE-2013-1968/ SUSE CVE CVE-2013-1968 page https://www.suse.com/security/cve/CVE-2013-2112/ SUSE CVE CVE-2013-2112 page https://www.suse.com/security/cve/CVE-2013-4277/ SUSE CVE CVE-2013-4277 page https://www.suse.com/security/cve/CVE-2013-4505/ SUSE CVE CVE-2013-4505 page https://www.suse.com/security/cve/CVE-2013-4558/ SUSE CVE CVE-2013-4558 page https://www.suse.com/security/cve/CVE-2014-0032/ SUSE CVE CVE-2014-0032 page https://www.suse.com/security/cve/CVE-2014-3528/ SUSE CVE CVE-2014-3528 page https://www.suse.com/security/cve/CVE-2014-3580/ SUSE CVE CVE-2014-3580 page https://www.suse.com/security/cve/CVE-2014-8108/ SUSE CVE CVE-2014-8108 page https://www.suse.com/security/cve/CVE-2015-0248/ SUSE CVE CVE-2015-0248 page https://www.suse.com/security/cve/CVE-2015-0251/ SUSE CVE CVE-2015-0251 page SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Studio Onsite 1.3 subversion-1.6.17-1.29.1 subversion-devel-1.6.17-1.29.1 subversion-perl-1.6.17-1.29.1 subversion-python-1.6.17-1.29.1 subversion-server-1.6.17-1.29.1 subversion-tools-1.6.17-1.29.1 subversion-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-devel-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-perl-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-python-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-server-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-tools-1.6.17-1.29.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 subversion-1.6.17-1.29.1 as a component of SUSE Studio Onsite 1.3 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory. CVE-2013-1845 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1845.html CVE-2013-1845 https://bugzilla.suse.com/813913 SUSE Bug 813913 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL. CVE-2013-1846 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1846.html CVE-2013-1846 https://bugzilla.suse.com/813913 SUSE Bug 813913 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist. CVE-2013-1847 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1847.html CVE-2013-1847 https://bugzilla.suse.com/813913 SUSE Bug 813913 The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL. CVE-2013-1849 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1849.html CVE-2013-1849 https://bugzilla.suse.com/813913 SUSE Bug 813913 The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable. CVE-2013-1884 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1884.html CVE-2013-1884 https://bugzilla.suse.com/813913 SUSE Bug 813913 Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name. CVE-2013-1968 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-1968.html CVE-2013-1968 https://bugzilla.suse.com/821505 SUSE Bug 821505 The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection. CVE-2013-2112 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-2112.html CVE-2013-2112 https://bugzilla.suse.com/821505 SUSE Bug 821505 Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option. CVE-2013-4277 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-4277.html CVE-2013-4277 https://bugzilla.suse.com/836245 SUSE Bug 836245 The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request. CVE-2013-4505 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-4505.html CVE-2013-4505 https://bugzilla.suse.com/850667 SUSE Bug 850667 https://bugzilla.suse.com/850747 SUSE Bug 850747 https://bugzilla.suse.com/862459 SUSE Bug 862459 The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /. CVE-2013-4558 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2013-4558.html CVE-2013-4558 https://bugzilla.suse.com/850667 SUSE Bug 850667 https://bugzilla.suse.com/850747 SUSE Bug 850747 https://bugzilla.suse.com/862459 SUSE Bug 862459 The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command. CVE-2014-0032 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2014-0032.html CVE-2014-0032 https://bugzilla.suse.com/862459 SUSE Bug 862459 Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. CVE-2014-3528 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2014-3528.html CVE-2014-3528 https://bugzilla.suse.com/889849 SUSE Bug 889849 https://bugzilla.suse.com/890511 SUSE Bug 890511 The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist. CVE-2014-3580 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2014-3580.html CVE-2014-3580 https://bugzilla.suse.com/909935 SUSE Bug 909935 https://bugzilla.suse.com/910376 SUSE Bug 910376 The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist. CVE-2014-8108 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2014-8108.html CVE-2014-8108 https://bugzilla.suse.com/909935 SUSE Bug 909935 The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. CVE-2015-0248 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2015-0248.html CVE-2015-0248 https://bugzilla.suse.com/923794 SUSE Bug 923794 The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. CVE-2015-0251 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-devel-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-perl-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-python-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-server-1.6.17-1.29.1 SUSE Linux Enterprise Software Development Kit 11 SP3:subversion-tools-1.6.17-1.29.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.29.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/ https://www.suse.com/security/cve/CVE-2015-0251.html CVE-2015-0251 https://bugzilla.suse.com/923795 SUSE Bug 923795