FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

subversion -- heap overflow vulnerability

Affected packages
p5-subversion < 1.6.4
py-subversion < 1.6.4
subversion < 1.6.4
subversion-freebsd < 1.6.4

Details

VuXML ID bce1f76d-82d0-11de-88ea-001a4d49522b
Discovery 2009-08-06
Entry 2009-08-06
Modified 2009-08-07

A Subversion Security Advisory reports:

Subversion clients and servers have multiple heap overflow issues in the parsing of binary deltas. This is related to an allocation vulnerability in the APR library used by Subversion.

Clients with commit access to a vulnerable server can cause a remote heap overflow; servers can cause a heap overflow on vulnerable clients that try to do a checkout or update.

This can lead to a DoS (an exploit has been tested) and to arbitrary code execution (no exploit tested, but the possibility is clear).

References

CVE Name CVE-2009-2411
URL http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt