USN-2348-1

Dashboard / Vulnerabilities / USN-2348-1

USN-2348-1

Summary: apt vulnerabilities

Details: It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487) It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-0488) It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489) It was discovered that APT did not correctly validate signatures when manually downloading packages using the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)

References: https://ubuntu.com/security/notices/USN-2348-1, https://ubuntu.com/security/CVE-2014-0487, https://ubuntu.com/security/CVE-2014-0488, https://ubuntu.com/security/CVE-2014-0489, https://ubuntu.com/security/CVE-2014-0490