GCVE - cpe:2.3:a:apache:subversion:1.8.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:subversion:1.8.9:*:*:*:*:*:*:*

part: a version: 1.8.9 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Subversion (`0384f294-d291-598e-baf4-379632e9d3cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/subversion`	purl2cpe	2026-06-01 10:14:31.497145
`pkg:deb/debian/subversion`	purl2cpe	2026-06-01 10:14:31.497146
`pkg:deb/ubuntu/subversion`	purl2cpe	2026-06-01 10:14:31.497148
`pkg:github/apache/subversion`	purl2cpe	2026-06-01 10:14:31.497149
`pkg:maven/org.apache.subversion/subversion`	purl2cpe	2026-06-01 10:14:31.497150
`pkg:rpm/centos/subversion`	purl2cpe	2026-06-01 10:14:31.497156
`pkg:rpm/fedora/subversion`	purl2cpe	2026-06-01 10:14:31.497157
`pkg:rpm/opensuse/subversion`	purl2cpe	2026-06-01 10:14:31.497159

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-8734`	vulnerable	2026-06-08 05:08:14.712477	Details available Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory. Published: 2017-10-16T13:00:00.000Z Updated: 2024-09-16T20:01:52.257Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/94588 https://lists.apache.org/thread.html/7798f5cda1b2a3c70db4be77694b12dec8fcc1a441b00009d44f0e09%40%3Cannounce.apache.org%3E http://www.securitytracker.com/id/1037361 http://www.debian.org/security/2017/dsa-3932 https://www.oracle.com/security-alerts/cpuoct2020.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3187`	vulnerable	2026-06-08 05:06:37.463825	Details available The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. Published: 2015-08-12T14:00:00.000Z Updated: 2024-08-06T05:39:31.612Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1742.html http://rhn.redhat.com/errata/RHSA-2015-1633.html https://support.apple.com/HT206172 http://www.debian.org/security/2015/dsa-3331 http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3184`	vulnerable	2026-06-08 05:06:37.445501	Details available mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. Published: 2015-08-12T14:00:00.000Z Updated: 2024-08-06T05:39:31.648Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1742.html https://support.apple.com/HT206172 http://www.debian.org/security/2015/dsa-3331 http://lists.opensuse.org/opensuse-updates/2015-08/msg00022.html http://www.securityfocus.com/bid/76274	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0251`	vulnerable	2026-06-08 05:06:14.140851	Details available The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. Published: 2015-04-08T18:00:00.000Z Updated: 2024-08-06T04:03:10.727Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1742.html http://www.debian.org/security/2015/dsa-3231 http://rhn.redhat.com/errata/RHSA-2015-1633.html http://seclists.org/fulldisclosure/2015/Jun/32 http://www.securityfocus.com/bid/74259	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0248`	vulnerable	2026-06-08 05:06:14.126112	Details available The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. Published: 2015-04-08T18:00:00.000Z Updated: 2024-08-06T04:03:10.500Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1742.html http://www.debian.org/security/2015/dsa-3231 http://rhn.redhat.com/errata/RHSA-2015-1633.html http://www.securityfocus.com/bid/74260 http://www.securitytracker.com/id/1033214	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0202`	vulnerable	2026-06-08 05:06:13.903631	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3580`	vulnerable	2026-06-08 05:05:33.590349	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3528`	vulnerable	2026-06-08 05:05:33.282170	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3522`	vulnerable	2026-06-08 05:05:33.212695	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3504`	vulnerable	2026-06-08 05:05:33.098082	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.