https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2012-0955.htmlhttps://patchthecve.com/cve/CVE-2012-0955.htmlTue, 16 Jun 2026 23:38:34 +0000MEDIUM 6.8: software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed https://patchthecve.com/cve/CVE-2011-4407.htmlhttps://patchthecve.com/cve/CVE-2011-4407.htmlTue, 16 Jun 2026 23:34:52 +0000MEDIUM 4.3: ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.https://patchthecve.com/cve/CVE-2013-1061.htmlhttps://patchthecve.com/cve/CVE-2013-1061.htmlTue, 16 Jun 2026 23:50:47 +0000MEDIUM 4.6: dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess