Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.
Stories per day · 30 days
1 RSS
14 stories, newest first · one card per story
Stories tagged #debian
Debian and Ubuntu APT flaw allows package swap
The flaw in APT lets MitM attackers swap verified packages and run code as root when retries are enabled.
Debian APT flaw lets attackers hijack updates and run code as root
CVE-2026-109518 in APT allows network attackers to replace verified packages and execute code as root on Debian releases.
Debian apt security update for CVE-2026-109518
Max Justicz found vulnerability allowing man-in-the-middle attackers to execute arbitrary code as root after HTTP redirects.
Debian apt security update fixes man-in-the-middle code execution
Max Justicz discovered a vulnerability in apt allowing man-in-the-middle attackers to execute arbitrary code as root by merging package downloads; fixed in version 3.0.4.
Debian's latest kernel security update has 1,313 reasons to patch
Debian kernel advisory DSA-6528-1 lists 1,313 CVEs, reflecting cautious assignment and AI-assisted bug hunting.
Debian has Patched 1,313 Flaws in Massive Update Leading to DoS and Privilege Escalation Attacks
Debian's DSA-6528-1 updates Trixie's Linux kernel to 6.12.111-1, fixing 1,313 CVE entries covering privilege escalation, DoS, and information leaks.
5
Several vulnerabilities have been discovered in the Linux kernel
Debian published DSA-6528-1, a Linux kernel update covering hundreds of CVEs.
Major rsync upgrade in Debian because of 33 CVEs
Debian bumps rsync to 3.5.0 on Trixie to fix 33 CVEs, with breaking security changes.
Re: "several" CVEs in latest Debian linux security advisory DSA 6528-1
Mailing list reply defends Debian's DSA 6528-1 advisory bundling many CVEs, citing changelog review effort to limit churn.
"several" CVEs in latest Debian linux security advisory DSA 6528-1
Debian DSA 6528-1 lists 1,313 Linux kernel CVEs that may enable privilege escalation, crashes, or leaks.
crontab(1) silently truncates file path arguments >=100 chars
A Debian bug report says crontab truncates file paths of 100 or more characters, risking the wrong crontab.
Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.
Debian developers rejected an LLM ban and left disclosure voluntary
Debian developers voted to encourage voluntary disclosure of AI assistance in contributions rather than banning or mandating labeling of LLM-generated code.
3