Update Manager vulnerability

2012-06-0400:00:00

ubuntu.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.005

Percentile

75.9%

JSON

Releases

Ubuntu 12.04
Ubuntu 11.10
Ubuntu 11.04

Packages

update-manager - GNOME application that manages apt updates

Details

USN-1443-1 fixed vulnerabilities in Update Manager. The fix for
CVE-2012-0949 was discovered to be incomplete. This update fixes the
problem.

Original advisory details:

Felix Geyer discovered that the Update Manager Apport hook incorrectly
uploaded certain system state archive files to Launchpad when reporting
bugs. This could possibly result in repository credentials being included
in public bug reports. (CVE-2012-0949)

OSVersionArchitecturePackageVersionFilename
Ubuntu12.04noarchupdate-manager-core< 1:0.156.14.5UNKNOWN
Ubuntu11.10noarchupdate-manager-core< 1:0.152.25.12UNKNOWN
Ubuntu11.04noarchupdate-manager-core< 1:0.150.5.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	12.04	noarch	update-manager-core	< 1:0.156.14.5	UNKNOWN
Ubuntu	11.10	noarch	update-manager-core	< 1:0.152.25.12	UNKNOWN
Ubuntu	11.04	noarch	update-manager-core	< 1:0.150.5.4	UNKNOWN