Input Validation and Logic

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.CVE-2014-0490Debian · 3.6% likely

   CWE-20

2. APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.CVE-2014-0489Debian · 3.6% likely

   CWE-20

3. Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.CVE-2011-0721Debian · 2.3% likely

   CWE-20

4. APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might a…CVE-2012-0954Debian · 2.2% likely

   CWE-20

5. APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via cra…CVE-2014-0488Debian · 2.1% likely

   CWE-20

6. apt 0.7.20 does not check when the date command returns an "invalid date" error, which can prevent apt from loading security updates in time zones for which DST occurs at midnight.CVE-2009-1300Debian · 1.9% likely

   CWE-20

7. APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initia…CVE-2011-1829Debian · 1.7% likely

   CWE-20

8. APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might a…CVE-2012-3587Debian · 1.7% likely

   CWE-20

9. APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signatu…CVE-2014-0478Debian · 1.6% likely

   CWE-20

10. apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknow…CVE-2013-1051Debian · 1.3% likely

    CWE-20

11. dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-d…CVE-2017-6964Debian · 0.5% likely

    CWE-252

12. Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/Linux, have an incons…CVE-2025-47153Debian · CVSS 6.5 · 0.4% likely

    CWE-1102

13. checkrestart in debian-goodies before 0.34 allows local users to gain privileges via shell metacharacters in the name of the executable file for a running process.CVE-2007-3912Debian · 0.3% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.