Vulnerability Description
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
CVSS Score
6.8
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Advanced Package Tool | 1.0.3 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/61275
- http://secunia.com/advisories/61286
- http://ubuntu.com/usn/usn-2348-1PatchVendor Advisory
- http://www.debian.org/security/2014/dsa-3025Vendor Advisory
- http://secunia.com/advisories/61275
- http://secunia.com/advisories/61286
- http://ubuntu.com/usn/usn-2348-1PatchVendor Advisory
- http://www.debian.org/security/2014/dsa-3025Vendor Advisory
FAQ
What is CVE-2014-0488?
CVE-2014-0488 is a vulnerability with a CVSS score of 6.8 (MEDIUM). APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.
How severe is CVE-2014-0488?
CVE-2014-0488 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-0488?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Advanced Package Tool.