Description
The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | viewvc | 1.1.5-1.1+squeeze2 | DSA-2563-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | viewvc | 1.1.24-2.1 | openSUSE-SU-2024:10175-1 |
Advisories 2
- DSA-2563-1 viewvc - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10175-1 viewvc-1.1.24-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120625 Re: CVE Request: viewvc mailing-list
- viewvc-svnra-info-disclosure(76615) vdb-entry
- 54199 vdb-entry
- openSUSE-SU-2012:0831 vendor-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0175
- http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2758
- 83227 vdb-entry
- MDVSA-2013:134 vendor-advisory
- DSA-2563 vendor-advisory