Posted by Jan Schaumann on Nov 04 This Debian Security Advisory for CVE-2026-109518 in apt(1) seems worth sharing more widely: https://lists.debian.org/debian-security-announce/2026/msg00526.html | Max Justicz discovered a vulnerability in the APT | package manager. APT can merge two different package | downloads after an HTTP redirect gives them the same | URI.
CVE-2026-109518: RCE in apt(1) (DSA 6607-1)
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/519
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's…
Apache OFBiz: CVE Announcements
Posted by Jacopo Cappellato on Nov 04 Multiple security vulnerabilities have been identified in Apache OFBiz, including some critical issues. Affected versions: All…
libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read)
Posted by nick on Nov 04 Hello, libtar's fix for CVE-2021-33643 and CVE-2021-33644 is incomplete. A crafted tar archive can still cause a heap out-of-bounds read…
USN-8996-1: APT vulnerability
Max Justicz discovered that APT incorrectly handled hard links when encountering redirects and retrying package downloads. A remote on-path attacker could possibly use…
CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
Posted by Arrigo Marchiori on Nov 03 Severity: important Affected versions: - Apache OpenOffice through 4.1.16 Description: An unchecked memory access in the PDF import…
OpenVox Server RCE and client impersonation vulnerabilities
Posted by Ben Ford on Nov 03 Hello from the OpenVox project. We released updates to mitigate two 9+ CVE vulnerabilities that affect all known OpenVox and Puppet versions…