Update Manager

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:canonical:update-manager:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorCanonical (bedcba35-8c3d-5a60-8532-2ba876a6ec88)
ProductUpdate Manager (5bbe4e3b-a772-5398-a0db-3b3aad05e3d4)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/ubuntu/update-manager purl2cpe 2026-06-01 10:12:42.675539

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2011-3154 vulnerable 2026-06-03 14:31:12.388623 Details available
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file content for a user via a symlink attack on the temporary file.
Published: 2014-04-17T14:00:00.000Z
Updated: 2024-08-06T23:22:27.594Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-3152 vulnerable 2026-06-03 14:31:12.362052 Details available
DistUpgrade/DistUpgradeFetcherCore.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 on Ubuntu 8.04 through 11.10 does not verify the GPG signature before extracting an upgrade tarball, which allows man-in-the-middle attackers to (1) create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or (2) bypass authentication via a crafted meta-release file.
Published: 2014-04-27T20:00:00.000Z
Updated: 2024-08-06T23:22:27.618Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.