CVE-2014-0488

APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.

Score

CVSS 2.0 6.8 Medium

Status

Modified - security@debian.org

Published

2014-11-03

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Advanced Package Tool (Debian)

References

• http://secunia.com/advisories/61275
• http://secunia.com/advisories/61286
• http://ubuntu.com/usn/usn-2348-1
• http://www.debian.org/security/2014/dsa-3025