MGASA-2017-0009
- Source
- https://advisories.mageia.org/MGASA-2017-0009.html
- Import Source
- https://advisories.mageia.org/MGASA-2017-0009.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2017-0009
- Related
- Published
- 2017-01-07T21:39:59Z
- Modified
- 2017-01-07T21:30:16Z
- Summary
- Updated subversion packages fix security vulnerability
- Details
-
Subversion's mod_dontdothat module and clients using http(s):// are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack, otherwise known as the "billion laughs attack", targets XML parsers and can cause the targeted process to consume an excessive amount of CPU resources or memory (CVE-2016-8734).
- References
-
- https://advisories.mageia.org/MGASA-2017-0009.html
- https://bugs.mageia.org/show_bug.cgi?id=19877
- https://lists.apache.org/thread.html/ecf3400585d1fd2ffc754bc348a4f7d9a4863573e11d551b3b287640@%3Cannounce.subversion.apache.org%3E
- http://svn.apache.org/repos/asf/subversion/tags/1.8.17/CHANGES
- http://subversion.apache.org/security/CVE-2016-8734-advisory.txt
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:5 / subversion
Package
- Name
- subversion
- Purl
- pkg:rpm/mageia/subversion?distro=mageia-5