CVE-2015-5259
HighInteger overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Published Jan 8, 2016 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2015-5259, UBUNTU-CVE-2015-5259
Key Facts
Patch immediately- CVE-2015-5259 is a high-severity vulnerability (CVSS 8.6 v3) affecting Subversion (Apache), mod24_dav_svn (amazon), mod_dav_svn (amazon) and 14 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 57% probability of exploitation in the next 30 days.
- Fixed versions are available, including libsvn_auth_gnome_keyring-1-0 1.9.5-1.1, libsvn_auth_kwallet-1-0 1.9.5-1.1, mod_dav_svn 1.8.15-1.52.amzn1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3
8.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS (30-day exploit likelihood)
57%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2015-5259 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Affected Products
36 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SubversionApache | 1.9.0, 1.9.1, 1.9.2 | 1.9.3-1 |
| mod24_dav_svnamazon | See advisory | 1.8.15-1.54.amzn1 |
| mod_dav_svnamazon | See advisory | 1.8.15-1.52.amzn1 |
| subversion-develamazon | See advisory | 1.8.15-1.54.amzn1 |
| subversion-javahlamazon | See advisory | 1.8.15-1.54.amzn1 |
Patched Releases
libsvn_auth_gnome_keyring-1-0
1.9.5-1.1
libsvn_auth_kwallet-1-0
1.9.5-1.1
mod_dav_svn
1.8.15-1.52.amzn1
mod24_dav_svn
1.8.15-1.54.amzn1
Subversion
1.8.15-1.54.amzn1, 1.9.3-1, 1.9.5-1.1
subversion-bash-completion
1.9.5-1.1
subversion-devel
1.8.15-1.54.amzn1, 1.9.5-1.1
subversion-javahl
1.8.15-1.54.amzn1
subversion-libs
1.8.15-1.54.amzn1
subversion-perl
1.8.15-1.54.amzn1, 1.9.5-1.1
subversion-python
1.9.5-1.1
subversion-python-ctypes
1.9.5-1.1
subversion-python26
1.8.15-1.54.amzn1
subversion-python27
1.8.15-1.54.amzn1
subversion-ruby
1.8.15-1.54.amzn1, 1.9.5-1.1
subversion-server
1.9.5-1.1
subversion-tools
1.8.15-1.54.amzn1, 1.9.5-1.1
Timeline
Publicly disclosed
Jan 8, 2016
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-122 Heap-based Buffer Overflow
- CWE-125 Out-of-bounds Read
- CWE-189
- CWE-190 Integer Overflow or Wraparound
References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2015-5259
- advisoryhttps://ubuntu.com/security/CVE-2015-5259
- advisoryhttp://subversion.apache.org/security/CVE-2015-5259-advisory.txt
- advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-5259
- otherGLSA-201610-05
FAQ
Common Questions.
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
Affected: Subversion (Apache) versions 1.9.0, 1.9.1, 1.9.2; mod24_dav_svn (amazon); mod_dav_svn (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including libsvn_auth_gnome_keyring-1-0 1.9.5-1.1, libsvn_auth_kwallet-1-0 1.9.5-1.1, mod_dav_svn 1.8.15-1.52.amzn1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2015-5259 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo