UBUNTU-CVE-2014-0488

APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.

References

Affected packages

Ubuntu:14.04:LTS / apt

Package

Name: apt
Purl: pkg:deb/ubuntu/apt@1.0.1ubuntu2.3?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.1ubuntu2.3

Affected versions

0.*

0.9.9.1~ubuntu3

0.9.9.1~ubuntu4

0.9.9.1~ubuntu5

0.9.13~exp1ubuntu1

0.9.13~exp1ubuntu2

0.9.13~exp1ubuntu3

0.9.13.1~ubuntu1

0.9.14.1ubuntu1

0.9.14.1ubuntu2

0.9.15.1ubuntu1

0.9.15.4ubuntu1

0.9.15.4ubuntu2

0.9.15.4ubuntu3

0.9.15.4ubuntu4

0.9.15.4ubuntu5

1.*

1.0.1ubuntu2

1.0.1ubuntu2.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "apt",
            "binary_version": "1.0.1ubuntu2.3"
        },
        {
            "binary_name": "apt-transport-https",
            "binary_version": "1.0.1ubuntu2.3"
        },
        {
            "binary_name": "apt-utils",
            "binary_version": "1.0.1ubuntu2.3"
        },
        {
            "binary_name": "libapt-inst1.5",
            "binary_version": "1.0.1ubuntu2.3"
        },
        {
            "binary_name": "libapt-pkg-dev",
            "binary_version": "1.0.1ubuntu2.3"
        },
        {
            "binary_name": "libapt-pkg4.12",
            "binary_version": "1.0.1ubuntu2.3"
        }
    ],
    "availability": "No subscription required"
}