GCVE - cpe:2.3:a:apache:subversion:1.4.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:subversion:1.4.2:*:*:*:*:*:*:*

part: a version: 1.4.2 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Subversion (`0384f294-d291-598e-baf4-379632e9d3cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/subversion`	purl2cpe	2026-06-01 10:14:31.371848
`pkg:deb/debian/subversion`	purl2cpe	2026-06-01 10:14:31.371850
`pkg:deb/ubuntu/subversion`	purl2cpe	2026-06-01 10:14:31.371851
`pkg:github/apache/subversion`	purl2cpe	2026-06-01 10:14:31.371853
`pkg:maven/org.apache.subversion/subversion`	purl2cpe	2026-06-01 10:14:31.371854
`pkg:rpm/centos/subversion`	purl2cpe	2026-06-01 10:14:31.371856
`pkg:rpm/fedora/subversion`	purl2cpe	2026-06-01 10:14:31.371857
`pkg:rpm/opensuse/subversion`	purl2cpe	2026-06-01 10:14:31.371859

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-8734`	vulnerable	2026-06-08 05:08:14.672970	Details available Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory. Published: 2017-10-16T13:00:00.000Z Updated: 2024-09-16T20:01:52.257Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94588 https://lists.apache.org/thread.html/7798f5cda1b2a3c70db4be77694b12dec8fcc1a441b00009d44f0e09%40%3Cannounce.apache.org%3E http://www.securitytracker.com/id/1037361 http://www.debian.org/security/2017/dsa-3932 https://www.oracle.com/security-alerts/cpuoct2020.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8108`	vulnerable	2026-06-08 05:06:07.604123	Details available The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist. Published: 2014-12-18T15:00:00.000Z Updated: 2024-08-06T13:10:50.164Z Open on db.gcve.eu Reference links http://subversion.apache.org/security/CVE-2014-8108-advisory.txt http://rhn.redhat.com/errata/RHSA-2015-0166.html https://support.apple.com/HT204427 http://www.securityfocus.com/bid/71725 http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3580`	vulnerable	2026-06-08 05:05:33.579893	Details available The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist. Published: 2014-12-18T15:00:00.000Z Updated: 2024-08-06T10:50:17.546Z Open on db.gcve.eu Reference links http://www.debian.org/security/2014/dsa-3107 http://rhn.redhat.com/errata/RHSA-2015-0166.html https://support.apple.com/HT204427 http://www.securityfocus.com/bid/71726 http://subversion.apache.org/security/CVE-2014-3580-advisory.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3528`	vulnerable	2026-06-08 05:05:33.280950	Details available Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. Published: 2014-08-19T18:00:00.000Z Updated: 2024-08-06T10:50:16.884Z Open on db.gcve.eu Reference links http://secunia.com/advisories/59432 http://www.ubuntu.com/usn/USN-2316-1 http://rhn.redhat.com/errata/RHSA-2015-0166.html https://support.apple.com/HT204427 http://www.securityfocus.com/bid/68995	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3522`	vulnerable	2026-06-08 05:05:33.211523	Details available The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. Published: 2014-08-19T18:00:00.000Z Updated: 2024-08-06T10:50:16.906Z Open on db.gcve.eu Reference links http://secunia.com/advisories/59432 http://www.ubuntu.com/usn/USN-2316-1 https://support.apple.com/HT204427 http://www.osvdb.org/109996 http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3504`	vulnerable	2026-06-08 05:05:33.065115	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4505`	vulnerable	2026-06-08 05:04:47.502198	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4277`	vulnerable	2026-06-08 05:04:35.068593	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0715`	vulnerable	2026-06-08 04:56:38.772053	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4644`	vulnerable	2026-06-08 04:56:29.789196	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-4539`	vulnerable	2026-06-08 04:56:29.076158	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.