CVE-2014-7206

NameCVE-2014-7206
DescriptionThe changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3048-1
NVD severitylow (attack range: local)
Debian Bugs763780

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apt (PTS)jessie (security), jessie1.0.9.8.4fixed
stretch1.4.8fixed
buster, sid1.6.3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
aptsource(unstable)1.0.9.2low763780
aptsourcesqueeze(not affected)
aptsourcewheezy0.9.7.9+deb7u6lowDSA-3048-1

Notes

[squeeze] - apt <not-affected> (apt changelog command and vulnerable code not present)
mitigated by Linux kernel features in wheezy and up

Search for package or bug name: Reporting problems