Lucene search

RedhatCVE-2015-5343

HistoryApr 14, 2016 - 2:59 p.m.

CVE-2015-5343

2016-04-1414:59:01

CWE-119

redhat

web.nvd.nist.gov

cve-2015-5343

apache subversion

integer overflow

mod_dav_svn

nvd

remote code execution

denial of service

memory consumption

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:P/I:P/A:C

CVSS3

7.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

AI Score

7.9

Confidence

High

EPSS

0.943

Percentile

99.2%

JSON

Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.

Affected configurations

Nvd

Node

apachesubversionRange1.7.0–1.7.20

apachesubversionRange1.8.0–1.8.15

apachesubversionRange1.9.0–1.9.3

Node

debiandebian_linuxMatch8.0

VendorProductVersionCPE
apachesubversion*cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*