Candidate: CVE-2015-5343
CRD: 2015-12-15
PublicDate: 2016-04-14 14:59:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5343
 https://subversion.apache.org/security/CVE-2015-5343-advisory.txt
Description:
 Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x
 before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to
 cause a denial of service (subversion server crash or memory consumption)
 and possibly execute arbitrary code via a skel-encoded request body, which
 triggers an out-of-bounds read and heap-based buffer overflow.
Ubuntu-Description: 
Notes: 
Bugs: 
Priority: medium
Discovered-by: Ivan Zhakov
Assigned-to: 
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H [7.6 HIGH]

Tags_subversion: universe-binary
Patches_subversion:
upstream_subversion: released (1.8.15,1.9.3)
precise_subversion: not-affected (code not present)
precise/esm_subversion: not-affected (code not present)
trusty_subversion: released (1.8.8-1ubuntu3.3)
trusty/esm_subversion: DNE (trusty was released [1.8.8-1ubuntu3.3])
vivid_subversion: ignored (reached end-of-life)
vivid/stable-phone-overlay_subversion: DNE
vivid/ubuntu-core_subversion: DNE
wily_subversion: ignored (reached end-of-life)
xenial_subversion: not-affected (1.9.3-1ubuntu1)
esm-infra/xenial_subversion: not-affected (1.9.3-1ubuntu1)
yakkety_subversion: not-affected (1.9.3-1ubuntu1)
zesty_subversion: not-affected (1.9.3-1ubuntu1)
devel_subversion: not-affected (1.9.3-1ubuntu1)