PatchTheCVEadvanced package tool vulnerabilities and fixes
Recent CVEs affecting advanced package tool, with upgrade or downgrade steps. 17 tracked.
Also searched as: advancedpackagetool.
advanced package tool has 17 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 9. Most recent: 2020-12-10. Highest priority: CVE-2019-3462 (score 63/100).
- CVE-2020-27351 LOW 2.0 MITIGATE Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, pytho
- CVE-2020-27350 MEDIUM 5.7 UPGRADE MITIGATE APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169,
- CVE-2019-3462 HIGH 8.1 UPGRADE MITIGATE Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can
- CVE-2018-0501 MEDIUM 5.9 MITIGATE UPGRADE The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~a
- CVE-2016-1252 MEDIUM 5.9 UPGRADE MITIGATE The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS be
- CVE-2014-7206 LOW 3.6 UPGRADE DOWNGRADE The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attac
- CVE-2014-6273 MEDIUM 6.8 UPGRADE Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attack
- CVE-2014-0490 HIGH 7.5 UPGRADE The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which all
- CVE-2014-0489 HIGH 7.5 DOWNGRADE APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows r
- CVE-2014-0488 MEDIUM 6.8 DOWNGRADE APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated st
- CVE-2014-0487 HIGH 7.5 DOWNGRADE APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modifie
- CVE-2014-0478 MEDIUM 4.0 UPGRADE APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to downl
- CVE-2013-1051 MEDIUM 4.3 DOWNGRADE DOWNGRADE apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-t
- CVE-2012-0961 LOW 2.1 DOWNGRADE DOWNGRADE Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7,
- CVE-2012-0214 MEDIUM 4.3 MITIGATE The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through
- CVE-2011-3634 LOW 2.6 UPGRADE MITIGATE methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and
- CVE-2011-3374 LOW 3.7 MITIGATE MITIGATE It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, le
FAQ
How do I fix advanced package tool vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is advanced package tool being exploited right now?
None of the tracked advanced package tool CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which advanced package tool CVE should I patch first?
CVE-2019-3462 currently ranks highest (63/100): Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can .