Skip to content
OpenAdvisories
Medium USN-4537-1 1 CVE

aptdaemon vulnerability

Published Sep 24, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Vaisha Bernard discovered that Aptdaemon incorrectly handled the Locale
property. A local attacker could use this issue to test for the presence of
local files.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS aptdaemon 1.1.1+bzr982-0ubuntu14.4
Ubuntu · 18.04 LTS 18.04:LTS aptdaemon 1.1.1+bzr982-0ubuntu19.4
Ubuntu · 20.04 LTS 20.04:LTS aptdaemon 1.1.1+bzr982-0ubuntu32.2

Vulnerabilities 1

  • Medium 4.0
    CVE-2020-15703

    aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property

    There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and …

    Canonical aptdaemon aptdaemon aptdaemon Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-15703