CVE-2014-0490
The apt-get download command in APT before 1.0.9 does not properly validate signatures for...
CVE-2014-0490 is a high vulnerability (CVSS 7.5) in Debian Advanced Package Tool, published September 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.61%, the 89th percentile. Fixed in apt 0.9.12.
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
Exploit likelihood
What each source reports
NVD Score used
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0490- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0490- Updated
- 2026-11-02
EUVDEUVD-2014-0521 No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
EUVD-2014-0521- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fgp5-9jf3-jfrv No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for...
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
GHSA-fgp5-9jf3-jfrv- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
CVE-2014-0490- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0490 No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
DEBIAN-CVE-2014-0490- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0490 No score
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.
- Record
UBUNTU-CVE-2014-0490- Updated
- 2026-11-02
OSVUSN-2348-1 No score
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when manually downloading packages using the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
- Record
USN-2348-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 0.9.12 | 0.9.12 |
aptDebian:13 |
before 0.9.12 | 0.9.12 |
aptDebian:14 |
before 0.9.12 | 0.9.12 |
aptDebian:7 |
before 0.9.7.9+deb7u3, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3 |
0.9.7.9+deb7u3 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.3, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 12 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.1 |
1.0.1ubuntu2.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |