Ubuntu Security Notice USN-2348-1: APT Vulnerabilities
USN-2348-1: APT vulnerabilities | Ubuntu security notices | Ubuntu

  
    
    16 September 2014
    Several security issues were fixed in APT.

    
        Reduce your security exposure
        Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
        Learn more about Ubuntu Pro
      
  
  
    
      Releases
      
        
          
            Ubuntu 14.04 ESM
          
        
          
            Ubuntu 12.04 
          
        
          
            Ubuntu 10.04 
          
        
      

      
        Packages
        
          
            apt - Advanced front-end for dpkg
          
        
      

      Details
      It was discovered that APT did not re-verify downloaded files when the
If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it
switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to
skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and
Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when
manually downloading packages using the download command. This issue only
applied to Ubuntu 12.04 LTS. (CVE-2014-0490)

    
    
        Reduce your security exposure
        Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.
        Learn more about Ubuntu Pro
      
  

  

  
  
  
  
