CVE-2016-1252

Publication date 13 December 2016

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apt	17.04 zesty	Fixed 1.4~beta2
	16.10 yakkety	Fixed 1.3.2ubuntu0.1
	16.04 LTS xenial	Fixed 1.2.15ubuntu0.2
	14.04 LTS trusty	Fixed 1.0.1ubuntu2.17
	12.04 LTS precise	Not affected

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2016-1252

Cvss 3 Severity Score

Description

Status

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references