apt

13 results · Feed

• High 7.7
  CVE-2026-109518 Public exploit

  APT RCE via hard link reuse

  On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

  Ubuntu Debian APT APT Debian Ubuntu Alpine
  Nov 4, 2026
• Medium 5.7
  CVE-2020-27350

  apt integer wraparound

  APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior …

  Canonical apt apt apt Debian Ubuntu
  Dec 10, 2020
• Unscored —
  CVE-2020-3810

  Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service wh…

  Debian APT apt apt Debian Ubuntu
  May 15, 2020
• Unscored —
  CVE-2019-3462 Public exploit EPSS 15%

  Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to c…

  Debian GNU/Linux apt as used in Debian Stretch and Ubuntu apt apt Debian Ubuntu
  Jan 28, 2019
• Unscored —
  CVE-2018-0501

  The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mis…

  apt apt Debian Ubuntu
  Aug 21, 2018
• Unscored —
  CVE-2016-1252 Public exploit

  The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.…

  apt apt Debian Ubuntu
  Dec 5, 2017
• Unscored —
  CVE-2014-0488

  APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, whic…

  apt apt Debian Ubuntu
  Nov 3, 2014
• Unscored —
  CVE-2014-0489

  APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote att…

  apt apt Debian Ubuntu
  Nov 3, 2014
• Unscored —
  CVE-2014-0487

  APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since h…

  apt apt Debian Ubuntu
  Nov 3, 2014
• Unscored —
  CVE-2014-0490

  The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remot…

  apt apt Debian Ubuntu
  Nov 3, 2014
• Unscored —
  CVE-2014-7206

  The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the …

  apt apt Debian Ubuntu
  Oct 15, 2014
• Unscored —
  CVE-2014-6273

  Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to ca…

  apt apt Debian Ubuntu
  Sep 30, 2014
• Unscored —
  CVE-2014-0478

  APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and i…

  apt apt Debian Ubuntu
  Jun 17, 2014