CVE-2014-7206

NameCVE-2014-7206
DescriptionThe changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3048-1
NVD severitylow
Debian Bugs763780

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apt (PTS)jessie1.0.9.8.4fixed
jessie (security)1.0.9.8.6fixed
stretch1.4.9fixed
stretch (security)1.4.10fixed
buster1.8.2fixed
buster (security)1.8.2.1fixed
bullseye, sid2.1.5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
aptsource(unstable)1.0.9.2763780
aptsourcesqueeze(not affected)
aptsourcewheezy0.9.7.9+deb7u6DSA-3048-1

Notes

[squeeze] - apt <not-affected> (apt changelog command and vulnerable code not present)
mitigated by Linux kernel features in wheezy and up

Search for package or bug name: Reporting problems