{"id":"CVE-2014-6273","aliases":["DEBIAN-CVE-2014-6273","DLA-58-1","DSA-3031-1","EUVD-2014-6159","GHSA-qxxp-8f4q-wv5v","MGASA-2014-0442","UBUNTU-CVE-2014-6273","USN-2353-1"],"status":"published","title":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the...","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02594,"percentile":0.85426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-09-23T00:00:00Z","modified":"2026-10-23T15:47:30Z","fixes":[{"ecosystem":"Debian:12","package":"apt","fixed_in":["1.0.3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apt","fixed_in":["1.0.3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apt","fixed_in":["1.0.3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"apt","fixed_in":["0.8.10.3+squeeze5"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"apt","fixed_in":["0.9.7.9+deb7u5"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"apt","fixed_in":["0.5.15lorg3.94-9.2.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"apt","fixed_in":["0.5.15lorg3.94-11.2.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"apt","fixed_in":["1.0.1ubuntu2.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.10.3+squeeze5"}]}],"versions":["0.8.10.3","0.8.10.3+squeeze1","0.8.10.3+squeeze2","0.8.10.3+squeeze3"]},{"source":"osv","ecosystem":"Debian:7","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7.9+deb7u5"}]}],"versions":["0.9.7.8","0.9.7.9","0.9.7.9+deb7u1","0.9.7.9+deb7u2","0.9.7.9+deb7u3","0.9.7.9+deb7u4","0.9.7.9~exp1","0.9.7.9~exp2","0.9.7.9~exp3"]},{"source":"osv","ecosystem":"Mageia:3","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15lorg3.94-9.2.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15lorg3.94-11.2.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1ubuntu2.4.1"}]}],"versions":["0.9.9.1~ubuntu3","0.9.9.1~ubuntu4","0.9.9.1~ubuntu5","0.9.13~exp1ubuntu1","0.9.13~exp1ubuntu2","0.9.13~exp1ubuntu3","0.9.13.1~ubuntu1","0.9.14.1ubuntu1","0.9.14.1ubuntu2","0.9.15.1ubuntu1","0.9.15.4ubuntu1","0.9.15.4ubuntu2","0.9.15.4ubuntu3","0.9.15.4ubuntu4","0.9.15.4ubuntu5","1.0.1ubuntu2","1.0.1ubuntu2.1","1.0.1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"apt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1ubuntu2.4.1"}]}],"versions":["0.9.9.1~ubuntu3","0.9.9.1~ubuntu4","0.9.9.1~ubuntu5","0.9.13~exp1ubuntu1","0.9.13~exp1ubuntu2","0.9.13~exp1ubuntu3","0.9.13.1~ubuntu1","0.9.14.1ubuntu1","0.9.14.1ubuntu2","0.9.15.1ubuntu1","0.9.15.4ubuntu1","0.9.15.4ubuntu2","0.9.15.4ubuntu3","0.9.15.4ubuntu4","0.9.15.4ubuntu5","1.0.1ubuntu2","1.0.1ubuntu2.1","1.0.1ubuntu2.3"]}],"products":[{"vendor":"debian","product":"advanced_package_tool"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2353-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.securityfocus.com/bid/70075","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/61710","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/96151","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3031","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/61605","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6273"},{"url":"https://github.com/advisories/GHSA-qxxp-8f4q-wv5v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-6273","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0442.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14112","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2353-1/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-6273","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2353-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-6273","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-6273","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-30T14:00:00Z","modified":"2024-08-06T12:10:13.271Z","updated_at":"2026-11-02T14:33:44.930749Z"}],"euvd":[{"id":"EUVD-2014-6159","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-30T14:00:00Z","modified":"2024-08-06T12:10:13Z","updated_at":"2026-11-03T01:57:00.015932Z"}],"ghsa":[{"id":"GHSA-qxxp-8f4q-wv5v","title":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the...","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2022-05-13T01:29:01Z","modified":"2023-02-01T05:08:06Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:40.636216Z"}],"nvd":[{"id":"CVE-2014-6273","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-30T14:55:11.517Z","modified":"2026-06-17T00:12:49.077Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:56.266125Z"}],"osv":[{"id":"CVE-2014-6273","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-30T14:55:11Z","modified":"2026-04-16T06:26:20.674881268Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-6273","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-30T14:55:11.517Z","modified":"2026-10-23T15:47:30.836023378Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-58-1","title":"apt - security update","status":"published","published":"2014-09-23T00:00:00Z","modified":"2026-03-09T02:09:09.918859Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3031-1","title":"apt - security update","status":"published","published":"2014-09-23T00:00:00Z","modified":"2026-03-09T01:23:19.134718Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0442","title":"Updated apt packages fix security vulnerability","description":"The Google Security Team discovered a buffer overflow vulnerability in the\nHTTP transport code in apt-get. An attacker able to man-in-the-middle a HTTP\nrequest to an apt repository can trigger the buffer overflow, leading to a\ncrash of the \"http\" apt method binary, or potentially to arbitrary code\nexecution (CVE-2014-6273).\n\nAlso fixed is parsing of Mageia package index \"synthesis\" files with lines\nlonger than 64k characters. This is necessary for upgrading to the \"cauldron\"\ndevelopment distro that will become Mageia 5. Note however that upgrading from\nMageia 3 to Mageia 5 will not be supported.\n","status":"published","published":"2014-11-12T09:56:47Z","modified":"2026-04-16T06:24:51.541028777Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-6273","description":"Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.","status":"published","published":"2014-09-23T16:00:00Z","modified":"2026-04-22T09:47:59.326731Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2353-1","title":"apt vulnerability","description":"It was discovered that APT incorrectly handled certain http URLs. If a\nremote attacker were able to perform a machine-in-the-middle attack, this flaw\ncould be exploited to cause APT to crash, resulting in a denial of service,\nor possibly execute arbitrary code. The default compiler options for\naffected releases should reduce the vulnerability to a denial of service.\n(CVE-2014-6273)\n\nIn addition, this update fixes regressions introduced by the USN-2348-1\nsecurity update: APT incorrectly handled file:/// sources on a different\npartition, incorrectly handled Dir::state::lists set to a relative path,\nand incorrectly handled cdrom: sources.\n","status":"published","published":"2014-09-23T16:12:19Z","modified":"2026-04-22T09:00:44.793283Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}