CVE-2016-8734
Fixed in a distro release EPSS 6%
Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.
Products: Apache Software Foundation Apache Subversion
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | subversion | 1.9.5-1 |
| Debian 13 | subversion | 1.9.5-1 |
| Debian 14 | subversion | 1.9.5-1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | subversion | 1.6.17-1.36.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | subversion | 1.8.19-25.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | subversion | 1.8.19-25.3.1 |
| SUSE Studio Onsite 1.3 | subversion | 1.6.17-1.36.9.1 |
| Ubuntu 14.04 LTS | subversion | 1.8.8-1ubuntu3.3 |
| Ubuntu 16.04 LTS | subversion | 1.9.3-2ubuntu1.1 |
| openSUSE Tumbleweed | subversion | 1.9.5-1.1 |