Summary
Jann Horn discovered that APT incorrectly handled InRelease files.
If a remote attacker were able to perform a machine-in-the-middle attack, this
flaw could potentially be used to install altered packages.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | apt | 1.0.1ubuntu2.17 |
| Ubuntu · 16.04 LTS 16.04:LTS | apt | 1.2.15ubuntu0.2 |
Vulnerabilities 1
-
Unscored —CVE-2016-1252 Public exploit
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.…
References
-
report
https://ubuntu.com/security/CVE-2016-1252