Security update for subversion SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:0043-1 Final 1 1 2016-01-07T10:19:23Z current 2016-01-07T10:19:23Z 2016-01-07T10:19:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for subversion This update fixes the following security issue: CVE-2015-5343: Possible remotely triggerable heap overflow and out-of-bounds read in mod_dav_svn caused by integer overflow when parsing skel-encoded request bodies. (bnc#958300) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SDK-12-2016-34,SUSE-SLE-SDK-12-SP1-2016-34 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20160043-1/ Link for SUSE-SU-2016:0043-1 https://lists.suse.com/pipermail/sle-security-updates/2016-January/001785.html E-Mail link for SUSE-SU-2016:0043-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/958300 SUSE Bug 958300 https://www.suse.com/security/cve/CVE-2015-5343/ SUSE CVE CVE-2015-5343 page SUSE Linux Enterprise Software Development Kit 12 SUSE Linux Enterprise Software Development Kit 12 SP1 libsvn_auth_gnome_keyring-1-0-1.8.10-18.2 libsvn_auth_kwallet-1-0-1.8.10-18.2 subversion-1.8.10-18.2 subversion-bash-completion-1.8.10-18.2 subversion-devel-1.8.10-18.2 subversion-perl-1.8.10-18.2 subversion-python-1.8.10-18.2 subversion-server-1.8.10-18.2 subversion-tools-1.8.10-18.2 libsvn_auth_gnome_keyring-1-0-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 libsvn_auth_kwallet-1-0-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-bash-completion-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-devel-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-perl-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-python-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-server-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 subversion-tools-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 libsvn_auth_gnome_keyring-1-0-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 libsvn_auth_kwallet-1-0-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-bash-completion-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-devel-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-perl-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-python-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-server-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 subversion-tools-1.8.10-18.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow. CVE-2015-5343 SUSE Linux Enterprise Software Development Kit 12 SP1:libsvn_auth_gnome_keyring-1-0-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:libsvn_auth_kwallet-1-0-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-bash-completion-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-devel-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-perl-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-python-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-server-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12 SP1:subversion-tools-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:libsvn_auth_gnome_keyring-1-0-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:libsvn_auth_kwallet-1-0-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-bash-completion-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-devel-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-perl-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-python-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-server-1.8.10-18.2 SUSE Linux Enterprise Software Development Kit 12:subversion-tools-1.8.10-18.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20160043-1/ https://www.suse.com/security/cve/CVE-2015-5343.html CVE-2015-5343 https://bugzilla.suse.com/958300 SUSE Bug 958300