« Volver al listado

CVE-2014-7206

Estado: ModificadaBaja (3.6)—

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Advanced Package ToolDebian — APT

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-7206",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-15T14:55:09.073",
  "references": [
    {
      "url": "http://secunia.com/advisories/61158",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/61333",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/61768",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3048",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/70310",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2370-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=763780",
      "source": "security@debian.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96951",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/61158",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/61333",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/61768",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3048",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/70310",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2370-1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=763780",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96951",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file."
    },
    {
      "lang": "es",
      "value": "El comando 'changelog' en Apt anterior a 1.0.9.2 permite a usuarios locales escribir ficheros arbitrarios a través de un ataque de enlaces simbólicos en el fichero 'changelog'."
    }
  ],
  "lastModified": "2026-06-17T00:14:33.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:debian:advanced_package_tool:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDAC8B26-1346-4622-8BFB-2AF7A1BEDD8E",
              "versionEndIncluding": "1.0.9.1"
            },
            {
              "criteria": "cpe:2.3:a:debian:advanced_package_tool:1.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E70C7BF1-F191-40F2-8247-916F1AB07FB4"
            },
            {
              "criteria": "cpe:2.3:a:debian:apt:0.9.7.9:ubunto3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06A404D3-1A48-4AAE-A2C7-399F84D35C05"
            },
            {
              "criteria": "cpe:2.3:a:debian:apt:0.9.7.9:ubunto4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BC51119-7345-4065-8BB6-74F641E4E152"
            },
            {
              "criteria": "cpe:2.3:a:debian:apt:0.9.7.9:ubunto5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43493B4D-F0AE-4B7A-8729-2DFC5FF30F00"
            },
            {
              "criteria": "cpe:2.3:a:debian:apt:1.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0041B2D4-89F7-4A48-9026-779E7DDC0763"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}