Integer overflow in the readstring function in libsvnra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
{ "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libapache2-mod-svn", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libapache2-mod-svn-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libapache2-svn", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-dev", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-dev-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-doc", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-java", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-java-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-perl", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-perl-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn-ruby1.8", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn1", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "libsvn1-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "python-subversion", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "python-subversion-dbg", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "python-subversion-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "ruby-svn", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "ruby-svn-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "subversion", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "subversion-dbg", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "subversion-dbgsym", "binary_version": "1.8.8-1ubuntu3.2" }, { "binary_name": "subversion-tools", "binary_version": "1.8.8-1ubuntu3.2" } ], "availability": "No subscription required" }