Subversion, Serf: Multiple Vulnerabilities Multiple vulnerabilities have been found in Subversion and Serf, the worst of which could lead to execution of arbitrary code. subversion serf October 11, 2016 October 11, 2016: 2 500482 518716 519202 545348 556076 567810 581448 586046 remote 1.9.4 1.8.16 1.9.4 1.3.7 1.3.7

Subversion is a version control system intended to eventually replace CVS. Like CVS, it has an optional client-server architecture (where the server can be an Apache server running mod_svn, or an ssh program as in CVS’s :ext: method). In addition to supporting the features found in CVS, Subversion also provides support for moving and copying files and directories.

The serf library is a high performance C-based HTTP client library built upon the Apache Portable Runtime (APR) library.

Multiple vulnerabilities have been discovered in Subversion and Serf. Please review the CVE identifiers referenced below for details

A remote attacker could possibly execute arbitrary code with the privileges of the process, conduct a man-in-the-middle attack, obtain sensitive information, or cause a Denial of Service Condition.

There is no known workaround at this time.

All Subversion users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=dev-vcs/subversion-1.9.4"

All Serf users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/serf-1.3.7" CVE-2014-0032 CVE-2014-3504 CVE-2014-3522 CVE-2014-3528 CVE-2015-0202 CVE-2015-0248 CVE-2015-0251 CVE-2015-3184 CVE-2015-3187 CVE-2015-5259 CVE-2016-2167 CVE-2016-2168 K_F b-man