← Vulnerability feed

Vulnerability record · CVE-2004-0413 · published 6 August 2004

CVE-2004-0413: Openpkg vulnerability

Openpkg · Openpkg

libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.

10.0 CVSS 2.0 High EPSS 5.9% · top 7.0%
10.0CVSS 2.0 base score
5.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn protocol URL strings, which allows remote attackers to cause a denial of service (memory consumption) and possibly execute arbitrary code via an integer overflow that leads to a heap-based buffer overflow.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt
http://www.gentoo.org/security/en/glsa/glsa-200406-07.xml Vendor Advisory
http://www.novell.com/linux/security/advisories/2004_18_subversion.html
http://www.securityfocus.com/advisories/6847
http://www.securityfocus.com/archive/1/365836
http://www.securityfocus.com/bid/10519 PatchVendor Advisory
https://bugzilla.fedora.us/show_bug.cgi?id=1748
https://exchange.xforce.ibmcloud.com/vulnerabilities/16396
http://subversion.tigris.org/security/CAN-2004-0413-advisory.txt
http://www.gentoo.org/security/en/glsa/glsa-200406-07.xml Vendor Advisory
http://www.novell.com/linux/security/advisories/2004_18_subversion.html
http://www.securityfocus.com/advisories/6847
http://www.securityfocus.com/archive/1/365836
http://www.securityfocus.com/bid/10519 PatchVendor Advisory
https://bugzilla.fedora.us/show_bug.cgi?id=1748
https://exchange.xforce.ibmcloud.com/vulnerabilities/16396

Track CVE-2004-0413 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2004-0990Gd graphics library gdlib vulnerabilityInteger overflow in GD Graphics Library libgd 2.0.28 (libgd2), and possibly other versions, allows remote attackers to cause a denial of service and …EPSS 28%10.0CVE-2004-1011Carnegie mellon university cyrus imap server vulnerabilityStack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbit…EPSS 5.8%10.0CVE-2004-1012Carnegie mellon university cyrus imap server vulnerabilityThe argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a c…EPSS 6.0%10.0CVE-2004-1013Carnegie mellon university cyrus imap server vulnerabilityThe argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via cer…EPSS 5.8%10.0CVE-2004-1019Openpkg improper input validation vulnerabilityThe deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code…EPSS 8.0%10.0CVE-2004-1065Openpkg vulnerabilityBuffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a l…EPSS 10%10.0CVE-2004-0333Openpkg vulnerabilityBuffer overflow in the UUDeview package, as used in WinZip 6.2 through WinZip 8.1 SR-1, and possibly other packages, allows remote attackers to execu…EPSS 24%10.0CVE-2004-0414Cvs vulnerabilityCVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, does not properly handle malformed "Entry" lines, which prevents a NULL terminator from being …EPSS 4.0%

Source: NIST National Vulnerability Database (record CVE-2004-0413), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.