CVE-2016-8734: vulnerability in Apache Subversion
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 6.4%
Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.
Affected products
Apache Software Foundation · Apache SubversionRelated CVEs — Apache Subversion
In the same product, most dangerous first.
CVE-2018-11803—CVE-2018-11803EPSS 58.5%CVE-2020-17525—Remote unauthenticated denial-of-service in Subversion mod_authz_svnEPSS 40.1%CVE-2017-9800—CVE-2017-9800EPSS 18.9%CVE-2022-24070—Apache Subversion mod_dav_svn is vulnerable to memory corruptionEPSS 8.9%CVE-2021-28544—Apache Subversion SVN authz protected copyfrom paths regressionEPSS 2.8%CVE-2024-46901LOWApache Subversion: mod_dav_svn denial-of-service via control characters in pathsEPSS 1.9%
References
https://lists.apache.org/thread.html/7798f5cda1b2a3c70db4be77694b12dec8fcc1a441b00009d44f0e09%40%3Cannounce.apache.org%3Ehttps://subversion.apache.org/security/CVE-2016-8734-advisory.txthttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://www.debian.org/security/2017/dsa-3932http://www.securityfocus.com/bid/94588http://www.securitytracker.com/id/1037361