CVE-2016-1252

Name of the Vulnerable Software and Affected Versions Debian versions prior to 1.0.9.8.4 Debian unstable versions prior to 1.4~beta2 Ubuntu 14.04 LTS versions prior to 1.0.1ubuntu2.17 Ubuntu 16.04 LTS versions prior to 1.2.15ubuntu0.2 Ubuntu 16.10 versions prior to 1.3.2ubuntu0.1

Description The issue allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

Recommendations For Debian versions prior to 1.0.9.8.4, update to version 1.0.9.8.4 or later. For Debian unstable versions prior to 1.4beta2, update to version 1.4beta2 or later. For Ubuntu 14.04 LTS versions prior to 1.0.1ubuntu2.17, update to version 1.0.1ubuntu2.17 or later. For Ubuntu 16.04 LTS versions prior to 1.2.15ubuntu0.2, update to version 1.2.15ubuntu0.2 or later. For Ubuntu 16.10 versions prior to 1.3.2ubuntu0.1, update to version 1.3.2ubuntu0.1 or later.