CVE-2014-0488 APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
MediumCVSS 6.8
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/apt(Debian:12) | < 1.0.9 | 1.0.9 |
| debian/apt(Debian:13) | < 1.0.9 | 1.0.9 |
| debian/apt(Debian:14) | < 1.0.9 | 1.0.9 |
| debian advanced package tool | = 1.0.3 | No fix listed |
| debian advanced package tool | = 1.0.7 | No fix listed |
References
- Debian Security Tracker CVE-2014-0488 vendor-advisory
- 61275 third-party-advisory
- 61286 third-party-advisory
- USN-2348-1 patch vendor-advisory
- DSA-3025 vendor-advisory