CVE-2013-1051

Published: 14 March 2013

apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.

Notes

Author	Note
mdeslaur	only oneiric+ support InRelease files

Priority

Status

Package	Release	Status
apt Launchpad, Ubuntu, Debian	hardy	Not vulnerable
	lucid	Not vulnerable
	oneiric	Released (0.8.16~exp5ubuntu13.7)
	precise	Released (0.8.16~exp12ubuntu10.10)
	quantal	Released (0.9.7.5ubuntu5.4)
	upstream	Needs triage

References

https://ubuntu.com/security/notices/USN-1762-1
https://www.cve.org/CVERecord?id=CVE-2013-1051
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›