APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
Published 2014-11-03 · Modified
6.8EPSS 0.021
Demo
ThreatFusionAI™ Product Walkthrough
The fastest way to see what ThreatFusionAI does is to run a search. Paste any hash, IP, domain or CVE and you'll get the full report, the connected indicators and the actor attribution in one pass.
What you'll see
• Verdicts from multiple antivirus engines
• The connected IOC graph you can click through
• Ranked threat actors based on ATT&CK overlap
Next step
Start with a free search, no card needed. Check the plans if you need more volume.
ThreatFusionAI AssistantAI help & guidance
AI assistant — can make mistakes. Verify important results.