QID 671120

Subversion is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.
Subversion only stores the differences between versions,instead of every complete file.
Subversion is intended to be a compelling replacement for cvs.
Security fix(es): apache subversion's mod_dontdothat module and http clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential xml entity expansion.
The attack can cause the targeted process to consume an excessive amount of cpu resources or memory.(cve-2016-8734) integer overflow in util.c in mod_dav_svn in apache subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.(cve-2015-5343) the canonicalize_username function in svnserve/cyrus_auth.c in apache subversion before 1.8.16 and 1.9.x before 1.9.4, when cyrus sasl authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.(cve-2016-2167) the req_check_access function in the mod_authz_svn module in the httpd server in apache subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (null pointer dereference and crash) via a crafted header in a (1) move or (2) copy request, involving an authorization check.(cve-2016-2168)

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.