Ubuntu
subversion package

  1. Bug #1487398
  2. Comment #5

Comment 5 for bug 1487398

Revision history for this message
Torbjorn (moa) wrote :

I finally found the time to take a deeper look at this. Turns out this bug is caused by CVE-2015-3184.patch. The SVN guys figured it out long ago, and fixed it: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c?r1=1695681&r2=1708699

I attach a modified version of that patch. It cures the bug if applied at the end of the patch chain in 1.8.8-1ubuntu3.3. The package you need to reinstall after rebuilding is libapache2-mod-svn.