{"id":"CVE-2014-0032","aliases":["BELL-CVE-2014-0032","DEBIAN-CVE-2014-0032","DLA-207-1","EUVD-2014-0133","GHSA-5jv6-mmqm-cjvm","MGASA-2014-0104","MGASA-2014-0105","RHSA-2014:0255","SUSE-SU-2015:0709-1","UBUNTU-CVE-2014-0032","USN-2316-1","openSUSE-SU-2024:10538-1"],"status":"published","title":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15...","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.11052,"percentile":0.95942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-02-14T00:00:00Z","modified":"2026-10-23T15:47:38Z","fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.8.8-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"subversion","fixed_in":["1.7.14-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"subversion","fixed_in":["1.8.8-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.12dfsg-7+deb6u2"}]}],"versions":["1.6.12dfsg-4","1.6.12dfsg-5","1.6.12dfsg-5~bpo50+1","1.6.12dfsg-6","1.6.12dfsg-6~bpo50+1","1.6.12dfsg-7"],"bundled":7},{"source":"osv","ecosystem":"Mageia:3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el5_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-10.el6_5"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu3.1"}]}],"versions":["1.7.9-1+nmu6ubuntu3","1.7.13-2ubuntu1","1.7.13-2ubuntu2","1.7.13-2ubuntu3","1.7.14-1ubuntu2","1.8.5-2ubuntu3","1.8.8-1ubuntu2","1.8.8-1ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-1.1"}]}],"bundled":37}],"products":[{"vendor":"apache","product":"subversion"}],"references":[{"url":"http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/56822","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/61321","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2316-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.osvdb.org/102927","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0255.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502%40reser.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://svn.apache.org/viewvc?view=revision\u0026revision=1557320","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/65434","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://support.apple.com/kb/HT6444","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/60722","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf%40ntlworld.com%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/90986","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201610-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0032","tags":["advisory"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502@reser.org%3E"},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf@ntlworld.com%3E"},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA@mail.gmail.com%3E"},{"url":"https://github.com/advisories/GHSA-5jv6-mmqm-cjvm"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-0032","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0032","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0104.html","tags":["advisory"]},{"url":"https://subversion.apache.org/security/CVE-2014-0032-advisory.txt","tags":["advisory","article"]},{"url":"https://mail-archives.apache.org/mod_mbox/subversion-dev/201402.mbox/%3C530633AC.2050507@apache.org%3E","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12059","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12768.mga3","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0105.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12768.mga4","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0255","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://subversion.apache.org/security/CVE-2013-1968-advisory.txt","tags":["article"]},{"url":"https://subversion.apache.org/security/CVE-2013-2112-advisory.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1062042","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0255.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1968","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1968","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1968","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2112","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2112","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2112","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0032","tags":["advisory","report"]},{"url":"http://subversion.apache.org/security/CVE-2014-0032-advisory.txt","tags":["article","report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/813913","tags":["report"]},{"url":"https://bugzilla.suse.com/821505","tags":["report"]},{"url":"https://bugzilla.suse.com/834014","tags":["report"]},{"url":"https://bugzilla.suse.com/836245","tags":["report"]},{"url":"https://bugzilla.suse.com/841205","tags":["report"]},{"url":"https://bugzilla.suse.com/850667","tags":["report"]},{"url":"https://bugzilla.suse.com/862459","tags":["report"]},{"url":"https://bugzilla.suse.com/889849","tags":["report"]},{"url":"https://bugzilla.suse.com/909935","tags":["report"]},{"url":"https://bugzilla.suse.com/910376","tags":["report"]},{"url":"https://bugzilla.suse.com/923794","tags":["report"]},{"url":"https://bugzilla.suse.com/923795","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0251","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-0032","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2316-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3522","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3528","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8734","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0032","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2014-02-14T15:00:00Z","modified":"2024-08-06T08:58:26.658Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0133","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2014-02-14T15:00:00Z","modified":"2024-08-06T08:58:26Z","updated_at":"2026-11-03T01:57:23.42372Z"}],"ghsa":[{"id":"GHSA-5jv6-mmqm-cjvm","title":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15...","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2022-05-17T01:29:12Z","modified":"2025-04-11T04:20:14Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.928203Z"}],"nvd":[{"id":"CVE-2014-0032","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2014-02-14T15:55:05.907Z","modified":"2026-06-17T00:02:07.29Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"BELL-CVE-2014-0032","title":"CVE-2014-0032 does not affect BellSoft software","status":"withdrawn","published":"2014-02-14T15:55:00Z","modified":"2026-01-28T07:20:12.988287Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-0032","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2014-02-14T15:55:05Z","modified":"2026-04-16T06:17:09.328765766Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0032","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"published","published":"2014-02-14T15:55:05.907Z","modified":"2026-10-23T15:47:38.477671687Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DLA-207-1","title":"subversion - security update","status":"published","published":"2015-04-24T00:00:00Z","modified":"2026-03-09T01:17:59.476316Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2014-0104","title":"Updated subversion packages fix CVE-2014-0032","description":"Updated subversion packages fix security vulnerability:\n\nThe mod_dav_svn module in Apache Subversion before 1.8.8, when\nSVNListParentPath is enabled, allows remote attackers to cause a denial\nof service (crash) via an OPTIONS request (CVE-2014-0032).\n\nThe package has been patched to correct this issue.\n\nAdditionally, the svnserve service was using the incorrect root directory\nfor the repositories.  This has also been corrected.  The root directory is\nnow defined in the /etc/sysconfig/svnserve file.\n","status":"published","published":"2014-02-27T21:58:42Z","modified":"2026-04-16T06:22:33.931339605Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0105","title":"Updated subversion packages fix CVE-2014-0032","description":"Updated subversion packages fix security vulnerability:\n\nThe mod_dav_svn module in Apache Subversion before 1.8.8, when\nSVNListParentPath is enabled, allows remote attackers to cause a denial of\nservice (crash) via an OPTIONS request (CVE-2014-0032).\n\nThe package has been updated to version 1.8.8, which fixes this issue, as\nwell as several others.\n","status":"published","published":"2014-02-27T22:00:06Z","modified":"2026-04-16T06:24:09.060732956Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10538-1","title":"libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:28.015865Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2014:0255","title":"Red Hat Security Advisory: subversion security update","status":"published","published":"2024-09-15T21:24:40Z","modified":"2026-06-26T12:20:54.935935635Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-SU-2015:0709-1","title":"Security update for subversion","description":"\nSubversion has been updated to fix a security problem:\n\n    * bnc#889849: Reveal authentication information through an md5\n      collision attack on authentication realm (CVE-2014-3528)\n\nSecurity Issues:\n\n    * CVE-2014-3528\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528\u003e\n\n","status":"published","published":"2014-08-19T23:56:28Z","modified":"2026-02-04T03:24:28.875941Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-0032","description":"The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the \"svn ls http://svn.example.com\" command.","status":"withdrawn","published":"2014-02-14T00:00:00Z","modified":"2026-02-04T04:13:19.572343Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-2316-1","title":"subversion vulnerabilities","description":"Lieven Govaerts discovered that the Subversion mod_dav_svn module\nincorrectly handled certain request methods when SVNListParentPath was\nenabled. A remote attacker could use this issue to cause the server to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n12.04 LTS. (CVE-2014-0032)\n\nBen Reser discovered that Subversion did not correctly validate SSL\ncertificates containing wildcards. A remote attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3522)\n\nBert Huijben discovered that Subversion did not properly handle cached\ncredentials. A malicious server could possibly use this issue to obtain\ncredentials cached for a different server. (CVE-2014-3528)\n","status":"published","published":"2014-08-14T17:42:53Z","modified":"2026-04-22T08:58:48.631224Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}