CVSS: 2.6EPSS: 0%CPEs: 12EXPL: 0CVE-2011-3634
https://notcve.org/view.php?id=CVE-2011-3634
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors. methods/https.cc en apt anterior a 0.8.11 acepta conexiones cuando el nombre de host del certificado falla la validación y Verify-Host está habilitado, lo que permite a atacantes man-in-the-middle obtener credenciales de repositorios a través de vectores no especificados. • http://people.canonical.com/~ubuntu-security/cve/2011/CVE-2011-3634.html http://www.ubuntu.com/usn/USN-1283-1 https://alioth.debian.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=apt/apt.git%3Ba=blob%3Bf=debian/changelog%3Bhb=HEAD https://bugs.launchpad.net/ubuntu/+source/apt/+bug/868353 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2011-1829
https://notcve.org/view.php?id=CVE-2011-1829
APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message. APT en versiones anteriores a la 0.8.15.2 no valida apropiadamente las firmas GPG adjuntas ("inline"), lo que permite atacantes de hombre en el medio ("man-in-the-middle") instalar paquetes modificados a través de vectores que involucran la falta de un mensaje inicial "clearsigned" (firmado en claro). • http://launchpadlibrarian.net/75126628/apt_0.8.13.2ubuntu2_0.8.13.2ubuntu4.1.diff.gz http://packages.debian.org/changelogs/pool/main/a/apt/current/changelog http://www.securityfocus.com/bid/48671 http://www.ubuntu.com/usn/USN-1169-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/68560 https://launchpad.net/bugs/784473 https://launchpad.net/ubuntu/+archive/primary/+sourcepub/1817196/+listing-archive-extra • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 2%CPEs: 180EXPL: 0CVE-2009-1358
https://notcve.org/view.php?id=CVE-2009-1358
apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has been revoked or expired, which might allow remote attackers to trick apt into installing malicious repositories. apt-get in apt anterior a 0.7.21 no comprueba adecuadamente el error de codigo en gpgv, lo que hace que apt utilice un repositorio firmado con una clave que ha sido revocada o ha caducado, lo que permite a atacantes remotos engañar a apt en la instlacion de repositorios maliciosos. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433091 http://secunia.com/advisories/34829 http://secunia.com/advisories/34832 http://secunia.com/advisories/34874 http://www.debian.org/security/2009/dsa-1779 http://www.securityfocus.com/bid/34630 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/356012 https://exchange.xforce.ibmcloud.com/vulnerabilities/50086 https://usn.ubuntu.com/762-1 •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1300
https://notcve.org/view.php?id=CVE-2009-1300
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight. apt 0.7.20 no comprueba si el comando "date" devuelve un error de "invalid date" (fecha no válida) que puede prevenir a apt de la carga de actualizaciones de seguridad en zonas horarias para las cuales DST se produce a medianoche. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523213 http://secunia.com/advisories/34829 http://secunia.com/advisories/34832 http://secunia.com/advisories/34874 http://www.debian.org/security/2009/dsa-1779 http://www.openwall.com/lists/oss-security/2009/04/08/11 https://bugs.launchpad.net/ubuntu/+source/coreutils/+bug/354793 https://usn.ubuntu.com/762-1 • CWE-20: Improper Input Validation •