Update Manager vulnerabilities

2012-05-1700:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

Confidence

Low

EPSS

0.005

Percentile

75.7%

JSON

Releases

Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04

Packages

update-manager - GNOME application that manages apt updates

Details

It was discovered that Update Manager created system state archive files
with incorrect permissions when upgrading releases. A local user could
possibly use this to read repository credentials. (CVE-2012-0948)

Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)

OSVersionArchitecturePackageVersionFilename
Ubuntu12.04noarchupdate-manager-core< 1:0.156.14.4UNKNOWN
Ubuntu11.10noarchupdate-manager-core< 1:0.152.25.11UNKNOWN
Ubuntu11.04noarchupdate-manager-core< 1:0.150.5.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	12.04	noarch	update-manager-core	< 1:0.156.14.4	UNKNOWN
Ubuntu	11.10	noarch	update-manager-core	< 1:0.152.25.11	UNKNOWN
Ubuntu	11.04	noarch	update-manager-core	< 1:0.150.5.3	UNKNOWN