CVEvulnerability

CVE-2013-1896

4.3 MEDIUM Published 2013-07-10 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-07-10
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P

Description

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

Affected configurations

• apache http server (>= 2.2.0 < 2.2.25) • apache http server (>= 2.4.1 < 2.4.6) • redhat jboss enterprise application platform 6.0.0 • redhat jboss enterprise application platform 6.4.0 • redhat enterprise linux desktop 5.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 5.9 • redhat enterprise linux eus 6.4 • redhat enterprise linux server 5.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 5.9 • redhat enterprise linux server aus 6.4 • redhat enterprise linux workstation 5.0 • redhat enterprise linux workstation 6.0 • canonical ubuntu linux 10.04 • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10 • canonical ubuntu linux 13.04 • opensuse opensuse 11.4 • opensuse opensuse 12.2 • opensuse opensuse 12.3

References