Your submission was sent successfully! Close

CVE-2014-7206

Published: 8 October 2014

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Notes

AuthorNote
mdeslaur
mitigated by symlink restrictions
Priority

Medium

Status

Package Release Status
apt
Launchpad, Ubuntu, Debian
lucid Not vulnerable
(code not present)
precise
Released (0.8.16~exp12ubuntu10.21)
trusty
Released (1.0.1ubuntu2.5)
upstream Needs triage

This vulnerability is mitigated in part by the use of symlink restrictions in Ubuntu. This vulnerability is mitigated in part by the use of hardlink restrictions in Ubuntu.