APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Advanced_package_tool | Debian | 1.0.3 (including) | 1.0.3 (including) |
| Advanced_package_tool | Debian | 1.0.7 (including) | 1.0.7 (including) |
| Apt | Ubuntu | devel | * |
| Apt | Ubuntu | esm-infra-legacy/trusty | * |
| Apt | Ubuntu | lucid | * |
| Apt | Ubuntu | precise | * |
| Apt | Ubuntu | trusty | * |
| Apt | Ubuntu | trusty/esm | * |