[ubuntu/precise-security] subversion 1.6.17dfsg-3ubuntu3.4 (Accepted)

[Marc Deslauriers]

subversion (1.6.17dfsg-3ubuntu3.4) precise-security; urgency=medium

  * SECURITY UPDATE: denial of service via mod_dav_svn
    - debian/patches/CVE-2014-0032.patch: only allow GET and HEAD in
      subversion/mod_dav_svn/repos.c.
    - CVE-2014-0032
  * SECURITY UPDATE: incorrect ssl cert validation
    - debian/patches/CVE-2014-3522.patch: properly validate hostnames in
      subversion/include/private/svn_cert.h,
      subversion/libsvn_ra_serf/util.c,
      subversion/libsvn_subr/dirent_uri.c,
      added tests to subversion/tests/libsvn_subr/dirent_uri-test.c.
    - CVE-2014-3522
  * SECURITY UPDATE: md5 collision authentication leak
    - debian/patches/CVE-2014-3528.patch: check if realm matches in
      subversion/libsvn_subr/config_auth.c.
    - CVE-2014-3528

Date: 2014-08-13 20:32:12.754052+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/precise/+source/subversion/1.6.17dfsg-3ubuntu3.4
-------------- next part --------------
Sorry, changesfile not available.