CVSS: 9.3EPSS: 7%CPEs: 11EXPL: 2CVE-2019-3462 – Debian Security Advisory 4371-1
https://notcve.org/view.php?id=CVE-2019-3462
22 Jan 2019 — Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. El saneamiento incorrecto de un campo de redirección 302 en el método HTTP "transport" en apt, en versiones 1.4.8 y anteriores, puede conducir a la inyección de contenido por parte de un atacante MITM, lo que puede conducir a la ejecución remota de código en el equipo objetivo. Max Justi... • https://github.com/tonejito/check_CVE-2019-3462 •
CVSS: 5.9EPSS: 1%CPEs: 5EXPL: 4CVE-2016-1252 – APT - Repository Signing Bypass via Memory Allocation Failure
https://notcve.org/view.php?id=CVE-2016-1252
14 Dec 2016 — The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures. El paquete apt, en Debian jessie en versiones anteriores a la 1.0.9.8.4; Debian inestable en versiones anteriores a la 1.4~bet... • https://packetstorm.news/files/id/140145 • CWE-295: Improper Certificate Validation •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2014-7206 – Debian Security Advisory 3048-1
https://notcve.org/view.php?id=CVE-2014-7206
08 Oct 2014 — The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file. El comando 'changelog' en Apt anterior a 1.0.9.2 permite a usuarios locales escribir ficheros arbitrarios a través de un ataque de enlaces simbólicos en el fichero 'changelog'. Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installat... • http://secunia.com/advisories/61158 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 0CVE-2014-0490 – Debian Security Advisory 3025-1
https://notcve.org/view.php?id=CVE-2014-0490
16 Sep 2014 — The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package. El comando de descarga apt-get en APT anterior a 1.0.9 no valida debidamente las firmas para paquetes, lo que permite a atacantes remotos ejecutar código arbitrario a través de un paquete manipulado. It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. It was discovered that APT did ... • http://secunia.com/advisories/61275 • CWE-20: Improper Input Validation •