Description
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apt | 0.7.21 | — |
| Debian 13 | apt | 0.7.21 | — |
| Debian 12 | apt | 0.7.21 | — |
| Debian 6.0 | apt | 0.7.20.2+squeeze1 | DTSA-199-1 |
| Debian 5.0 | apt | 0.7.20.2+lenny1 | DSA-1779-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | apt | 0.6.46.4-0.1+etch1 | DSA-1779-1 |
Advisories 2
- DSA-1779-1 apt - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-199-1 apt - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 34874 third-party-advisory
- https://bugs.launchpad.net/ubuntu/+source/coreutils/+bug/354793
- DSA-1779 vendor-advisory
- 34829 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=523213
- [oss-security] 20090408 CVE request: apt mailing-list
- 34832 third-party-advisory
- USN-762-1 vendor-advisory