CVE-2004-0397
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier...
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
Exploit likelihood
What each source reports
NVD Score used
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
CVE-2004-0397- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
CVE-2004-0397- Updated
- 2026-11-02
EUVDEUVD-2004-0397 No score
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
EUVD-2004-0397- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vwxm-8m4v-97wg No score
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier...
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
GHSA-vwxm-8m4v-97wg- Updated
- 2026-11-02
OSV No score
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
CVE-2004-0397- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0397 No score
Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remote attackers to execute arbitrary code via a (1) DAV2 REPORT query or (2) get-dated-rev svn-protocol command.
- Record
DEBIAN-CVE-2004-0397- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
subversionDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
subversionDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
subversionDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Subversion - Date Svnserve (Metasploit) | 2010-08-07 |
| Exploit-DB | Subversion 1.0.2 - 'svn_time_from_cstring()' Remote Overflow | 2004-06-25 |
| Exploit-DB | Subversion 1.0.2 - Date Overflow (Metasploit) | 2004-05-19 |
| Metasploit | Subversion Date Svnserve | 2004-05-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0397 is a high vulnerability (CVSS 7.5) in Subversion, published May 28, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.2%, the 99th percentile. Fixed in subversion 1.0.3-1.
References
securityfocus.com/bid/10386
bugzilla.fedora.us/show_bug.cgi?id=1748
lists.grok.org.uk/pipermail/full-disclosure/2004-May/021737.html
subversion.tigris.org/svn-sscanf-advisory.txt
marc.info?l=bugtraq&m=108498676517697&w=2
Show 10 moreShow less
linuxsecurity.com/advisories/fedora_advisory-4373.html
gentoo.org/security/en/glsa/glsa-200405-14.xml
osvdb.org/6301
secunia.com/advisories/11675
exchange.xforce.ibmcloud.com/vulnerabilities/16191
security.e-matters.de/advisories/082004.html
nvd.nist.gov/vuln/detail/CVE-2004-0397
github.com/advisories/GHSA-vwxm-8m4v-97wg
security-tracker.debian.org/tracker/CVE-2004-0397