CVE-2016-1252: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 7.2% chance of exploitation in the next 30 days.

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 16.10 only
• Debian Advanced Package Tool: before 1.0.9.8.4 (fixed in 1.0.9.8.4)

Published 2017-12-05. Last modified 2026-06-17.