CVE-2009-2411

Severity: high (CVSS 8.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-08-07 · updated 2026-06-16
Weakness: CWE-189

Description

Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.

Affected products

Subversion: through 1.5.6; 0.22.1, 0.23.0, 0.24.0, 0.24.1, 0.24.2, 0.25.0 (+57)

References

http://archives.neohapsis.com/archives/bugtraq/2009-08/0056.html
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
http://osvdb.org/56856
http://secunia.com/advisories/36184
http://secunia.com/advisories/36224
http://secunia.com/advisories/36232
http://secunia.com/advisories/36257
http://secunia.com/advisories/36262
http://subversion.tigris.org/security/CVE-2009-2411-advisory.txt
http://support.apple.com/kb/HT3937
http://svn.collab.net/repos/svn/tags/1.5.7/CHANGES
http://svn.collab.net/repos/svn/tags/1.6.4/CHANGES

Get alerted when CVE-2009-2411 or the next vulnerability affects your stack