Ubuntu 12.04 LTS / 12.10 / 13.04 : software-properties vulnerability (USN-1960-1)

It was discovered that Software Properties was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory...

USN-1960-1: Software Properties vulnerability

It was discovered that Software Properties was using polkit in an unsafe manner. A local attacker could possibly use this issue to bypass intended polkit authorizations...

CVE-2013-1061

dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProce...

CVE-2012-5356

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

Code injection

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

CVE-2012-5356

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

CVE-2012-5356

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

CVE-2012-5356

The CVE affects the apt-add-repository component of Ubuntu Software Properties. Versions prior to the listed fixes (0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8) fail to properly validate PPA GPG keys fetched from a key...

PT-2012-5951

Name of the Vulnerable Software and Affected Versions Ubuntu Software Properties versions 0.75.x through 0.75.9, Ubuntu Software Properties versions 0.80.x through 0.80.9.1, Ubuntu Software Properties versions 0.81.x through 0.81.13.4, Ubuntu Software Properties versions 0.82.x through 0.82.7.2,...

CVE-2012-5356: Improper Input Validation

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

Ubuntu Update for software-properties USN-1588-1

Ubuntu Update for Linux kernel vulnerabilities USN-1588-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN15881.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for software-properties USN-1588-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-1588-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : software-properties vulnerability (USN-1588-1)

It was discovered that the apt-add-repository tool incorrectly validated PPA GPG keys when importing from a keyserver. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to install altered package repository GPG keys. Note that Tenable Network...

USN-1588-1: Software Properties vulnerability

It was discovered that the apt-add-repository tool incorrectly validated PPA GPG keys when importing from a keyserver. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to install altered package repository GPG keys...

Ubuntu utilities security vulnerabilities

AccountsService and Software Properties privlege escalation...

Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : software-properties vulnerability (USN-1352-1)

David Black discovered that Software Properties incorrectly validated server certificates when performing secure connections to download PPA GPG key fingerprints. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to install altered package reposito...

Ubuntu Update for software-properties USN-1352-1

Ubuntu Update for Linux kernel vulnerabilities USN-1352-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13521.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for software-properties USN-1352-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...

Ubuntu: Security Advisory (USN-1352-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-1352-1: Software Properties vulnerability

David Black discovered that Software Properties incorrectly validated server certificates when performing secure connections to download PPA GPG key fingerprints. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to install altered package...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...