From announce-returnkatrina81@example.com  Sat May 14 12:20:37 2011
Return-Path: <announce-returnkatrina81@example.com>
X-Original-To: katrina81@example.com
Delivered-To: katrina81@example.com
Received: from mail.apache.org (hermes.apache.org [83.161.120.155])
	by minotaur.apache.org (Postfix) with SMTP id 0933A6C32
	for <katrina81@example.com>; Sat, 14 May 2011 12:20:37 +0000 (UTC)
Received: (qmail 15870 invoked by uid 500); 14 May 2011 12:13:15 -0000
Delivered-To: katrina81@example.com
Received: (qmail 15837 invoked by uid 500); 14 May 2011 12:13:15 -0000
Mailing-List: contact katrina81@example.com; run by ezmlm
Precedence: bulk
List-Help: <mailto:katrina81@example.com>
List-Unsubscribe: <mailto:katrina81@example.com>
List-Post: <mailto:katrina81@example.com>
List-Id: <announce.subversion.apache.org>
Delivered-To: mailing list katrina81@example.com
Delivered-To: moderator for katrina81@example.com
Received: (qmail 69076 invoked by uid 99); 14 May 2011 11:30:49 -0000
X-ASF-Spam-Status: No, hits=-0.0 required=5.0
	tests=RCVD_IN_DNSWL_LOW,SPF_NEUTRAL
X-Spam-Check-By: apache.org
Received-SPF: neutral (nike.apache.org: local policy)
MIME-Version: 1.0
Sender: katrina81@example.com
X-Originating-IP: [83.161.120.155]
Date: Sat, 14 May 2011 11:30:20 +0000
X-Google-Sender-Auth: -dGNBJRqE__HDFNrOORgOQvNJTk
Message-ID: <katrina81@example.com>
Subject: Vulnerability in APR: CVE-2011-0419
From: Hyrum Wright <katrina81@example.com>
To: announce <katrina81@example.com>
Content-Type: text/plain; charset=ISO-8859-1
X-Virus-Checked: Checked by ClamAV on apache.org

To interested persons:

Apache Subversion uses the Apache Portable Runtime (APR) to provide
platform-specific and other utility services.  APR announced the
availability of APR 1.4.4, which addresses CVE-2011-0419, a potential
unconstrained recursion bug in the apr_fnmatch().  An attacker could
potentially exploit this issue to cause the target machine to exhaust
stack memory or use excessive CPU.  Prior to Subversion 1.6.16,
Subversion used the compromised function on untrusted data in
mod_dav_svn, exposing it to this flaw.

In Subversion 1.6.16, mod_dav_svn was changed to avoid the use of
apr_fnmatch(), eliminating this attack vector for Subversion.  Thus,
Subversion systems are only vulnerable if they are running *both* APR
< 1.4.4 and Subversion < 1.6.16.  It is recommended that users upgrade
one or both of these components as soon as is convenient.

To read more about the APR 1.4.4 release, see
http://www.apache.org/dist/apr/Announcement1.x.html

- The Subversion Team


{'source': 'Apache Software Foundation Public Mail Archives'}