AP
Product
Advanced Package Tool
21
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 3Low 2
Watch
Add Advanced Package Tool to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3462 | 8.1 | Jan 28 | Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to… Affected: before 1.2.30; 1.3 through 1.4.8 |
| CVE-2018-0501 | 5.9 | Aug 21 | The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of… Affected: 1.6.0 before 1.6.4; 1.7.0; 1.7.0; 1.7.0 |
| CVE-2016-1252 | 5.9 | Dec 5 | The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and… Affected: before 1.0.9.8.4 |
| CVE-2020-27350 | 5.7 | Dec 10 | APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and… Affected: 1.2.32ubuntu0 before 1.2.32ubuntu0.2; 1.6.12ubuntu0 before 1.6.12ubuntu0.2; 2.0.2ubuntu0 before 2.0.2ubuntu0.2; 2.1.10ubuntu0 before 2.1.10ubuntu0.2; before 1.8.2.2 |
| CVE-2011-3374 | 3.7 | Nov 26 | It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack Affected: All versions, or not specified |
| CVE-2020-27351 | 2.8 | Dec 10 | Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170 Affected: 1.1.0\~beta1 before 1.1.0\~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 before 1.6.5ubuntu0.4; 2.0.0ubuntu0 before 2.0.0ubuntu0.20.04.2; 2.1.3ubuntu1 before 2.1.30ubuntu1.1; before 1.8.4.2 |
| CVE-2014-0490 | – | Nov 3 | The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package Affected: through 1.0.8; 1.0.3; 1.0.4; 1.0.5; 1.0.6; 1.0.7 |
| CVE-2014-0489 | – | Nov 3 | APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package Affected: 1.0.3; 1.0.5; 1.0.7 |
| CVE-2014-0488 | – | Nov 3 | APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via… Affected: 1.0.3; 1.0.7 |
| CVE-2014-0487 | – | Nov 3 | APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors Affected: 1.0.3; 1.0.7 |
| CVE-2014-7206 | – | Oct 15 | The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file Affected: through 1.0.9.1; 1.0.8 |
| CVE-2014-6273 | – | Sep 30 | Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute… Affected: through 1.0.1 |
| CVE-2014-0478 | – | Jun 17 | APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release… Affected: through 1.0.3 |
| CVE-2011-3634 | – | Mar 1 | methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to… Affected: through 0.8.10.3; 0.8.0; 0.8.0; 0.8.0; 0.8.1; 0.8.10; +2 more |
| CVE-2013-1051 | – | Mar 21 | apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via… Affected: 0.8.16 |
| CVE-2012-0961 | – | Dec 26 | Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses… Affected: 0.8.16 |
| CVE-2012-3587 | – | Jun 19 | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might… Affected: 0.7.0; 0.7.1; 0.7.2; 0.7.2-0.1; 0.7.10; 0.7.11; +34 more |
| CVE-2012-0954 | – | Jun 19 | APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might… Affected: 0.7.0; 0.7.1; 0.7.2; 0.7.2-0.1; 0.7.10; 0.7.11; +34 more |
| CVE-2011-1829 | – | Jul 27 | APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an… Affected: before 0.8.15.2 |
| CVE-2009-1358 | – | Apr 21 | apt-get in apt before 0.7.21 does not check for the correct error code from gpgv, which causes apt to treat a repository as valid even when it has been signed with a key that has… Affected: through 0.7.20; 0.7.0; 0.7.1; 0.7.2; 0.7.2-0.1; 0.7.10; +19 more |
| CVE-2009-1300 | – | Apr 16 | apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight Affected: 0.7.20 |
Showing 21