CVE-2014-8108

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0166.htmlThird Party Advisory
http://secunia.com/advisories/61131
http://subversion.apache.org/security/CVE-2014-8108-advisory.txtPatch, Vendor Advisory
http://www.securityfocus.com/bid/71725
http://www.ubuntu.com/usn/USN-2721-1
https://support.apple.com/HT204427Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0166.htmlThird Party Advisory
http://secunia.com/advisories/61131
http://subversion.apache.org/security/CVE-2014-8108-advisory.txtPatch, Vendor Advisory
http://www.securityfocus.com/bid/71725
http://www.ubuntu.com/usn/USN-2721-1
https://support.apple.com/HT204427Third Party Advisory

Timeline

Published: Dec 18, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-81094.3mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which th CVE-2014-81104.3Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remot CVE-2014-81115.0Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attacker CVE-2014-81124.0389 Directory Server 1.3.1.x, 1.3.2.x before 1.3.2.27, and 1.3.3.x before 1.3.3.9 stores "unhashed" passwords even when the nsslapd-unhashed CVE-2014-81146.8The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading craf CVE-2014-81156.5The default authorization constrains in KIE Workbench 6.0.x allows remote authenticated users to read or write to arbitrary files, bypass in CVE-2014-81165.0The ELF parser (readelf.c) in file before 5.21 allows remote attackers to cause a denial of service (CPU consumption or crash) via a large n CVE-2014-81175.0softmagic.c in file before 5.21 does not properly limit recursion, which allows remote attackers to cause a denial of service (CPU consumpti CVE-2014-811810.0Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section CVE-2014-81197.5The find_ifcfg_path function in netcf before 0.2.7 might allow attackers to cause a denial of service (application crash) via vectors involv CVE-2014-81204.4The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the JMX management URLs of all loc CVE-2014-81215.0DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly