CVE-2014-8108

Publication date 18 December 2014

Last updated 24 July 2024

Ubuntu priority

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
subversion	15.04 vivid	Fixed 1.8.10-5ubuntu1
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Fixed 1.8.8-1ubuntu3.2
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Ignored end of life

How can I get the fixes?
What do statuses mean?

Notes

tyhicks

libapache2-mod-svn (libapache2-svn in older releases) is a universe binary

mdeslaur

code introduced in 1.7

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2721-1
Subversion vulnerabilities
20 August 2015

Other references

http://subversion.apache.org/security/CVE-2014-8108-advisory.txt
http://secunia.com/advisories/61131
https://www.cve.org/CVERecord?id=CVE-2014-8108