Debian
Debian Advanced Package Tool: vulnerabilidades y CVE
Debian Advanced Package Tool tiene 21 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE21
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2020-27351 | Baja (2.8) | 0.40% | — | 10 dic 2020 | — |
| CVE-2020-27350 | Media (5.7) | 0.38% | — | 10 dic 2020 | — |
| CVE-2011-3374 | Baja (3.7) | 1.2% | — | 26 nov 2019 | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack. |
| CVE-2019-3462 | Alta (8.1) | 15% | — | 28 ene 2019 | Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target… |
| CVE-2018-0501 | Media (5.9) | 0.95% | — | 21 ago 2018 | The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail. |
| CVE-2016-1252 | Media (5.9) | 7.2% | — | 5 dic 2017 | The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1… |
| CVE-2014-0490 | Alta (7.5) | 3.6% | — | 3 nov 2014 | The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package. |
| CVE-2014-0489 | Alta (7.5) | 3.6% | — | 3 nov 2014 | APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package. |
| CVE-2014-0488 | Media (6.8) | 2.1% | — | 3 nov 2014 | APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data. |
| CVE-2014-0487 | Alta (7.5) | 1.9% | — | 3 nov 2014 | APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors. |
| CVE-2014-7206 | Baja (3.6) | 0.39% | — | 15 oct 2014 | The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file. |
| CVE-2014-6273 | Media (6.8) | 2.4% | — | 30 sept 2014 | Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL. |
| CVE-2014-0478 | Media (4) | 1.6% | — | 17 jun 2014 | APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature. |
| CVE-2011-3634 | Baja (2.6) | 0.81% | — | 1 mar 2014 | methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via… |
| CVE-2013-1051 | Media (4.3) | 1.3% | — | 21 mar 2013 | apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity… |
| CVE-2012-0961 | Baja (2.1) | 0.35% | — | 26 dic 2012 | Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for… |
| CVE-2012-3587 | Baja (2.6) | 1.7% | — | 19 jun 2012 | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan… |
| CVE-2012-0954 | Baja (2.6) | 2.2% | — | 19 jun 2012 | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered… |
| CVE-2011-1829 | Media (4.3) | 1.7% | — | 27 jul 2011 | APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message. |
| CVE-2009-1358 | Alta (10) | 4.5% | — | 21 abr 2009 | apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might… |
| CVE-2009-1300 | Alta (10) | 1.9% | — | 16 abr 2009 | apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight. |