You are not logged in.
- Topics: Active | Unanswered
#1 Today 08:14:31
- jue-gen
- Member
- Registered: 2022-07-07
- Posts: 131
Security vulnerability in APT allows execution of malicious code
I’m not entirely confident in my English, so I have a question: Has a security update arrived in Devuan? How can I check this?
Package : apt
CVE ID : CVE-2026-109518
Max Justicz discovered a vulnerability in the APT package manager. APT
can merge two different package downloads after an HTTP redirect gives
them the same URI. Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification, resulting in the execution of arbitrary code as root.
For the stable distribution (trixie), this problem has been fixed in
version 3.0.4. Additionally this update addresses several out-of-bounds
access issues.
We recommend that you upgrade your apt packages.
Offline
