GoogleOSV:DSA-3025-1apt - security update
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
It was discovered that APT, the high level package manager, does not
properly invalidate unauthenticated data
(
CVE-2014-0488), performs
incorrect verification of 304 replies
(
CVE-2014-0487), does not perform
the checksum check when the Acquire::GzipIndexes option is used
(
CVE-2014-0489) and does not properly perform validation for binary
packages downloaded by the apt-get download command
(
CVE-2014-0490).
For the stable distribution (wheezy), these problems have been fixed in
version 0.9.7.9+deb7u3.
For the unstable distribution (sid), these problems have been fixed in
version 1.0.9.
We recommend that you upgrade your apt packages.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apt | eq | 0.9.7.8 | |
| apt | eq | 0.9.7.9+deb7u1 | |
| apt | eq | 0.9.7.9~exp2 | |
| apt | eq | 0.9.7.9+deb7u2 | |
| apt | eq | 0.9.7.9~exp3 | |
| apt | eq | 0.9.7.9~exp1 | |
| apt | eq | 0.9.7.9 |
References
Related
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P