CVE-2016-1252

The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures.

• CWE-295

• http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3156-1Third Party Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1020Exploit, Issue Tracking, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467Exploit, Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2016/dsa-3733Issue Tracking, Vendor Advisory
• https://www.exploit-db.com/exploits/40916/Exploit, Issue Tracking, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.htmlIssue Tracking, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3156-1Third Party Advisory
• https://bugs.chromium.org/p/project-zero/issues/detail?id=1020Exploit, Issue Tracking, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467Exploit, Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2016/dsa-3733Issue Tracking, Vendor Advisory
• https://www.exploit-db.com/exploits/40916/Exploit, Issue Tracking, Third Party Advisory, VDB Entry

Published

Dec 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1246Buffer overflow in the DBD::mysql module before 4.037 for Pe…
• CVE-2016-1247The nginx package before 1.6.2-5+deb8u3 on Debian jessie, th…7.8
• CVE-2016-1248vim before patch 8.0.0056 does not properly validate values …
• CVE-2016-1249The DBD::mysql module before 4.039 for Perl, when using serv…
• CVE-2016-1250Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1251There is a vulnerability of type use-after-free affecting DB…
• CVE-2016-1253The most package in Debian wheezy before 5.0.0a-2.2, in Debi…
• CVE-2016-1254Tor before 0.2.8.12 might allow remote attackers to cause a …
• CVE-2016-1255The pg_ctlcluster script in postgresql-common package in Deb…
• CVE-2016-1256Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-…
• CVE-2016-1257The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8…
• CVE-2016-1258Embedthis Appweb, as used in J-Web in Juniper Junos OS befor…