CVE-2018-11803

NameCVE-2018-11803
DescriptionSubversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
subversion (PTS)jessie1.8.10-6+deb8u6fixed
jessie (security)1.8.10-6+deb8u5fixed
stretch1.9.5-1+deb9u3fixed
stretch (security)1.9.5-1+deb9u1fixed
buster, sid1.10.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
subversionsource(unstable)1.10.4-1medium
subversionsourcejessie(not affected)
subversionsourcestretch(not affected)

Notes

[stretch] - subversion <not-affected> (Vulnerable code introduced in 1.10.0)
[jessie] - subversion <not-affected> (Vulnerable code introduced in 1.10.0)
https://subversion.apache.org/security/CVE-2018-11803-advisory.txt
https://www.openwall.com/lists/oss-security/2019/01/23/1

Search for package or bug name: Reporting problems