← Back to branch summary

~ubuntu-security/ubuntu-cve-tracker/master

« back to all changes in this revision

Viewing changes to active/CVE-2016-8734

  • Committer: Steve Beattie
  • Date: 2019-02-19 06:18:27 UTC
  • Revision ID: sbeattie@ubuntu.com-20190219061827-oh57fzcfc1u9dlfk
The ubuntu-cve-tracker project has been converted to git.

Please use 'git clone https://git.launchpad.net/ubuntu-cve-tracker' to
get the converted tree.

Show diffs side-by-side

added added

removed removed

Lines of Context:
active/CVE-2016-8734
1
 
PublicDateAtUSN: 2016-11-30
2
 
Candidate: CVE-2016-8734
3
 
PublicDate: 2017-10-16
4
 
References:
5
 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8734
6
 
 https://subversion.apache.org/security/CVE-2016-8734-advisory.txt
7
 
 https://usn.ubuntu.com/usn/usn-3388-1
8
 
Description:
9
 
 Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16,
10
 
 and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused
11
 
 by exponential XML entity expansion. The attack can cause the targeted
12
 
 process to consume an excessive amount of CPU resources or memory.
13
 
Ubuntu-Description:
14
 
 Florian Weimer discovered that Subversion clients did not properly
15
 
 restrict XML entity expansion when accessing http(s):// URLs. A remote
16
 
 attacker could use this to cause a denial of service.
17
 
Notes:
18
 
 mdeslaur> for mod_dontdothat, we don't ship it in binary packages
19
 
 mdeslaur> for clients, we build with serf, so we're vulnerable
20
 
Bugs:
21
 
Priority: low
22
 
Discovered-by: Florian Weimer
23
 
Assigned-to:
24
 
 
25
 
Patches_subversion:
26
 
 upstream: https://subversion.apache.org/security/CVE-2016-8734-advisory.txt
27
 
upstream_subversion: released (1.9.5-1, 1.8.17, 1.9.5)
28
 
precise_subversion: ignored (reached end-of-life)
29
 
precise/esm_subversion: needed
30
 
trusty_subversion: released (1.8.8-1ubuntu3.3)
31
 
vivid/stable-phone-overlay_subversion: DNE
32
 
vivid/ubuntu-core_subversion: DNE
33
 
xenial_subversion: released (1.9.3-2ubuntu1.1)
34
 
yakkety_subversion: ignored (reached end-of-life)
35
 
zesty_subversion: not-affected (1.9.5-1ubuntu1)
36
 
artful_subversion: not-affected (1.9.5-1ubuntu1)
37
 
bionic_subversion: not-affected (1.9.5-1ubuntu1)
38
 
devel_subversion: not-affected (1.9.5-1ubuntu1)