Mageia alert MGASA-2015-0326 (subversion)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0326: Updated subversion packages fix security vulnerabilities 
Date:
    	     
 
Thu, 27 Aug 2015 22:50:16 +0200
Message-ID:
    	     
 
<20150827205016.9A7E642FD3@valstar.mageia.org>
MGASA-2015-0326 - Updated subversion packages fix security vulnerabilities

Publication date: 27 Aug 2015
URL: http://advisories.mageia.org/MGASA-2015-0326.html

Type: security
Affected Mageia releases: 4, 5
CVE: CVE-2015-3184,
     CVE-2015-3187

Description:
Subversion's mod_authz_svn does not properly restrict anonymous access in some
mixed anonymous/authenticated environments when using Apache httpd 2.4.  The
result is that anonymous access may be possible to files for which only
authenticated access should be possible (CVE-2015-3184).

Subversion servers, both httpd and svnserve, will reveal some paths that
should be hidden by path-based authz.  When a node is copied from an
unreadable location to a readable location the unreadable path may be
revealed.  This vulnerablity only reveals the path, it does not reveal the
contents of the path (CVE-2015-3187).

This update also re-enables the java subpackage for the Mageia 5 subversion
package (mga#16075).

References:
- https://bugs.mageia.org/show_bug.cgi?id=16572

- https://bugs.mageia.org/show_bug.cgi?id=16075

- http://subversion.apache.org/security/CVE-2015-3184-advis...
- http://subversion.apache.org/security/CVE-2015-3187-advis...
- http://svn.haxx.se/dev/archive-2015-08/0024.shtml

- http://svn.apache.org/repos/asf/subversion/tags/1.8.14/CH...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3184

- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3187


SRPMS:
- 4/core/subversion-1.8.14-1.mga4
- 5/core/subversion-1.8.14-1.mga5