CVE-2009-1300
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can...
CVE-2009-1300 is a high vulnerability (CVSS 10.0) in Debian Advanced Package Tool, published April 6, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in apt 0.7.21.
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
Exploit likelihood
What each source reports
NVD Score used
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
CVE-2009-1300- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
CVE-2009-1300- Updated
- 2026-11-02
EUVDEUVD-2009-1298 No score
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
EUVD-2009-1298- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3cfj-r393-3gq3 No score
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can...
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
GHSA-3cfj-r393-3gq3- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
CVE-2009-1300- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1300 No score
apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.
- Record
DEBIAN-CVE-2009-1300- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 0.7.21 | 0.7.21 |
aptDebian:13 |
before 0.7.21 | 0.7.21 |
aptDebian:14 |
before 0.7.21 | 0.7.21 |
aptDebian:4.0 |
before 0.6.46.4-0.1+etch1, plus listed versions 0.6.46.4-0.1 |
0.6.46.4-0.1+etch1 |
aptDebian:5.0 |
before 0.7.20.2+lenny1, plus listed versions 0.7.20.10.7.20.2 |
0.7.20.2+lenny1 |
aptDebian:6.0 |
before 0.7.20.2+squeeze1 | 0.7.20.2+squeeze1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |