CVE-2014-7206

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a...

3.6 LowFix available

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Exploit likelihood

0.39%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
Updated: 2026-11-02

EUVDEUVD-2014-7079 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: EUVD-2014-7079
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pvf6-chpc-2vfx No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a...

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: GHSA-pvf6-chpc-2vfx
Weakness: CWE-59
Updated: 2026-11-02

OSV No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-7206 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: DEBIAN-CVE-2014-7206
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-7206 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: UBUNTU-CVE-2014-7206
Updated: 2026-11-02

OSVUSN-2370-1 No score

apt vulnerability

Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the kernel link restrictions.

Record: USN-2370-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apt` Debian:12	before 1.0.9.2	1.0.9.2
`apt` Debian:13	before 1.0.9.2	1.0.9.2
`apt` Debian:14	before 1.0.9.2	1.0.9.2
`apt` Debian:7	before 0.9.7.9+deb7u6, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9+deb7u3 Show 5 moreShow less 0.9.7.9+deb7u40.9.7.9+deb7u50.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3	0.9.7.9+deb7u6
`apt` Ubuntu:14.04:LTS	before 1.0.1ubuntu2.5, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 14 moreShow less 0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.11.0.1ubuntu2.31.0.1ubuntu2.4.1	1.0.1ubuntu2.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7206 is a low vulnerability (CVSS 3.6) in Debian Apt, published October 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in apt 1.0.9.2.

References

Show 8 moreShow less