Skip to content

CVE-2014-7206

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a...

3.6 LowFix available

CVE-2014-7206 is a low vulnerability (CVSS 3.6) in Debian Apt, published October 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 32nd percentile. Fixed in apt 1.0.9.2.

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Exploit likelihood

0.39%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
Updated: 2026-11-02

EUVDEUVD-2014-7079 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: EUVD-2014-7079
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pvf6-chpc-2vfx No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a...

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: GHSA-pvf6-chpc-2vfx
Weakness: CWE-59
Updated: 2026-11-02

OSV No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: CVE-2014-7206
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-7206 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: DEBIAN-CVE-2014-7206
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-7206 No score

The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.

Record: UBUNTU-CVE-2014-7206
Updated: 2026-11-02

OSVUSN-2370-1 No score

apt vulnerability

Guillem Jover discovered that APT incorrectly created a temporary file when handling the changelog command. A local attacker could use this issue to overwrite arbitrary files. In the default installation of Ubuntu, this should be prevented by the kernel link restrictions.

Record: USN-2370-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apt` Debian:12	before 1.0.9.2	1.0.9.2
`apt` Debian:13	before 1.0.9.2	1.0.9.2
`apt` Debian:14	before 1.0.9.2	1.0.9.2
`apt` Debian:7	before 0.9.7.9+deb7u6, plus listed versions 0.9.7.80.9.7.90.9.7.9+deb7u10.9.7.9+deb7u20.9.7.9+deb7u3 Show 5 moreShow less 0.9.7.9+deb7u40.9.7.9+deb7u50.9.7.9~exp10.9.7.9~exp20.9.7.9~exp3	0.9.7.9+deb7u6
`apt` Ubuntu:14.04:LTS	before 1.0.1ubuntu2.5, plus listed versions 0.9.9.1~ubuntu30.9.9.1~ubuntu40.9.9.1~ubuntu50.9.13~exp1ubuntu10.9.13~exp1ubuntu2 Show 14 moreShow less 0.9.13~exp1ubuntu30.9.13.1~ubuntu10.9.14.1ubuntu10.9.14.1ubuntu20.9.15.1ubuntu10.9.15.4ubuntu10.9.15.4ubuntu20.9.15.4ubuntu30.9.15.4ubuntu40.9.15.4ubuntu51.0.1ubuntu21.0.1ubuntu2.11.0.1ubuntu2.31.0.1ubuntu2.4.1	1.0.1ubuntu2.5

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 8 moreShow less