CVSS: 9.3EPSS: 10%CPEs: 11EXPL: 2CVE-2019-3462 – Debian Security Advisory 4371-1
https://notcve.org/view.php?id=CVE-2019-3462
22 Jan 2019 — Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. El saneamiento incorrecto de un campo de redirección 302 en el método HTTP "transport" en apt, en versiones 1.4.8 y anteriores, puede conducir a la inyección de contenido por parte de un atacante MITM, lo que puede conducir a la ejecución remota de código en el equipo objetivo. Max Justi... • https://github.com/tonejito/check_CVE-2019-3462 •
CVSS: 5.9EPSS: 6%CPEs: 5EXPL: 4CVE-2016-1252 – APT - Repository Signing Bypass via Memory Allocation Failure
https://notcve.org/view.php?id=CVE-2016-1252
14 Dec 2016 — The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures. El paquete apt, en Debian jessie en versiones anteriores a la 1.0.9.8.4; Debian inestable en versiones anteriores a la 1.4~bet... • https://packetstorm.news/files/id/140145 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2014-7206 – Debian Security Advisory 3048-1
https://notcve.org/view.php?id=CVE-2014-7206
08 Oct 2014 — The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file. El comando 'changelog' en Apt anterior a 1.0.9.2 permite a usuarios locales escribir ficheros arbitrarios a través de un ataque de enlaces simbólicos en el fichero 'changelog'. Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installat... • http://secunia.com/advisories/61158 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6273 – Ubuntu Security Notice USN-2353-1
https://notcve.org/view.php?id=CVE-2014-6273
24 Sep 2014 — Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL. Desbordamiento de buffer en el código de transporte HTTP en apt-get en APT 1.0.1 y anteriores permite a atacantes man-in-the-middle causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una URL manipulada. It was discovered that APT incorrectly handled certain http... • http://secunia.com/advisories/61605 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •