CVE-2014-0487
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using...
CVE-2014-0487 is a high vulnerability (CVSS 7.5) in Debian Advanced Package Tool, published September 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in apt 1.0.9.
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
Exploit likelihood
What each source reports
NVD Score used
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
CVE-2014-0487- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
CVE-2014-0487- Updated
- 2026-11-02
EUVDEUVD-2014-0518 No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
EUVD-2014-0518- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fmfx-3g63-34p4 No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using...
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
GHSA-fmfx-3g63-34p4- Updated
- 2026-11-02
OSV No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
CVE-2014-0487- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0487 No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
DEBIAN-CVE-2014-0487- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0487 No score
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.
- Record
UBUNTU-CVE-2014-0487- Updated
- 2026-11-02
OSVUSN-2348-1 No score
apt vulnerabilities
It was discovered that APT did not re-verify downloaded files when the If-Modified-Since wasn't met. (CVE-2014-0487)
It was discovered that APT did not invalidate repository data when it switched from an unauthenticated to an authenticated state. (CVE-2014-0488)
It was discovered that the APT Acquire::GzipIndexes option caused APT to skip checksum validation. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS, and was not enabled by default. (CVE-2014-0489)
It was discovered that APT did not correctly validate signatures when manually downloading packages using the download command. This issue only applied to Ubuntu 12.04 LTS. (CVE-2014-0490)
- Record
USN-2348-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aptDebian:12 |
before 1.0.9 | 1.0.9 |
aptDebian:13 |
before 1.0.9 | 1.0.9 |
aptDebian:14 |
before 1.0.9 | 1.0.9 |
aptDebian:6.0 |
before 0.8.10.3+squeeze3, plus listed versions 0.8.10.30.8.10.3+squeeze10.8.10.3+squeeze2 |
0.8.10.3+squeeze3 |
aptDebian:7 |
before 0.9.7.9+deb7u3, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3 |
0.9.7.9+deb7u3 |
aptUbuntu:14.04:LTS |
before 1.0.1ubuntu2.3, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 12 moreShow less0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.1 |
1.0.1ubuntu2.3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |