CVE-2014-7206

NameCVE-2014-7206
DescriptionThe changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3048-1
Debian Bugs763780

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apt (PTS)buster1.8.2.3fixed
buster (security)1.8.2.2fixed
bullseye2.2.4fixed
bookworm, sid2.5.5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
aptsourcesqueeze(not affected)
aptsourcewheezy0.9.7.9+deb7u6DSA-3048-1
aptsource(unstable)1.0.9.2763780

Notes

[squeeze] - apt <not-affected> (apt changelog command and vulnerable code not present)
mitigated by Linux kernel features in wheezy and up

Search for package or bug name: Reporting problems