CVE-2016-1252
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu...
CVE-2016-1252 is a medium vulnerability (CVSS 5.9) in Canonical Ubuntu Linux, published December 13, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.25%, the 94th percentile. Fixed in apt 1.4~beta2.
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
CVE-2016-1252- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
CVE-2016-1252- Updated
- 2026-11-02
EUVDEUVD-2016-2351 No score
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
EUVD-2016-2351- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-53rm-7gr9-9hfx
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu...
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
GHSA-53rm-7gr9-9hfx- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
CVE-2016-1252- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-1252
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
DEBIAN-CVE-2016-1252- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-1252
The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.
- Record
UBUNTU-CVE-2016-1252- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUSN-3156-1 No score
apt vulnerability
Jann Horn discovered that APT incorrectly handled InRelease files. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could potentially be used to install altered packages.
- Record
USN-3156-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.4~beta2 | 1.4~beta2 |
aptDebian:13 |
before 1.4~beta2 | 1.4~beta2 |
aptDebian:14 |
before 1.4~beta2 | 1.4~beta2 |
aptDebian:8 |
before 1.0.9.8.4, plus listed versions 1.0.9.81.0.9.8.11.0.9.8.21.0.9.8.3 |
1.0.9.8.4 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.17, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 25 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.11.0.1ubuntu2.31.0.1ubuntu2.4.11.0.1ubuntu2.51.0.1ubuntu2.61.0.1ubuntu2.71.0.1ubuntu2.81.0.1ubuntu2.91.0.1ubuntu2.101.0.1ubuntu2.111.0.1ubuntu2.121.0.1ubuntu2.131.0.1ubuntu2.141.0.1ubuntu2.15 |
1.0.1ubuntu2.17 |
aptUbuntu:16.04:LTS |
before 1.2.15ubuntu0.2, plus listed versions 1.0.10.2ubuntu11.1.41.1.51.1.101.2.3 Show 9 moreShow less1.2.41.2.61.2.71.2.81.2.91.2.101.2.10ubuntu11.2.12~ubuntu16.04.11.2.15 |
1.2.15ubuntu0.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | APT - Repository Signing Bypass via Memory Allocation Failure | 2016-12-14 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |