View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-2167 low priority: Ubuntu including 1 source packages (subversion), 8 status rows across 8 suites (artful, precise, trusty, upstream, wily, xenial, yakkety, zesty): not-affected 3, released 3, ignored 2.
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.