![\"\"](\"https:\/\/www.deepin.org\/wp-content\/uploads\/2026\/11\/\u82f1\u6587_\u526f\u672c.png\")
<\/p>\nDear deepin users and community members,<\/span><\/p>\n A vulnerability has been discovered in APT, the package manager, that allows package integrity verification to be bypassed. Under specific conditions, an attacker positioned on the network path can substitute a package of their own making for one that has already passed verification, and have it executed with root privileges.<\/span><\/p>\n Since APT is the component through which every system update passes, the impact of exploitation would be substantial. All users are advised to update as soon as possible.<\/span><\/p>\n <\/p>\n CVE ID:<\/span><\/strong><\/span> CVE-2026-109518<\/span><\/p>\n Description:<\/span><\/strong><\/span> When following an HTTP redirect, APT can merge two different package downloads into the same target file. If the download is then retried (resumed), the reused hard link is handled improperly, opening a window between verification and use \u2014 a time-of-check to time-of-use (TOCTOU) condition. An attacker can replace the contents of a package after it has been verified, so that the package ultimately installed differs from the one that was checked. This bypasses the verification boundary without requiring a valid signature on the replacement package. Reported by Max Justicz.<\/span><\/p>\n Severity:<\/span><\/strong><\/span> \u26a0\ufe0f\u26a0\ufe0f\u26a0\ufe0f <\/span>High<\/span><\/strong><\/span> (CVSS v4.0: 7.7)<\/span><\/p>\n Prerequisites:<\/span><\/strong><\/span><\/p>\n The attacker is on the network path (same LAN, a rogue proxy, or a compromised mirror);<\/span><\/p>\n<\/li>\n The package repository is fetched over HTTP and redirects are followed;<\/span><\/p>\n<\/li>\n A successfully installed package runs with root privileges. No exploitation in the wild has been reported to date.<\/span><\/p>\n <\/p>\n All deepin 25 users who have not yet applied this update.<\/span><\/p>\n <\/p>\n deepin 25:<\/span><\/strong><\/span><\/p>\n Please update via <\/span>Control Center<\/span><\/strong><\/span>, or from a terminal:<\/span><\/p>\n sudo apt update && sudo apt dist-upgrade<\/span><\/p>\n Afterwards, confirm the version with <\/span> Note:<\/span><\/strong><\/span> the download of the patched apt itself is still performed by the old, vulnerable apt. We recommend completing this update from a trusted network. If you cannot update immediately, running <\/span> That's all for this update. Thank you, as always, for supporting the deepin community!<\/span><\/p>","protected":false},"excerpt":{"rendered":" Dear deepin users and community members, A vulnerability has been discovered in APT, the package manager, that allows package integrity verification to be bypassed. Under specific conditions, an attacker positioned on the network path can substitute a package of their own making for one that has already passed verification, and have it executed with root privileges. Since APT is the component through which every system update passes, the impact of exploitation would be substantial. All users are advised to update as soon as possible. Vulnerability details CVE ID: CVE-2026-109518 Description: When following an HTTP redirect, APT can merge two ...Read more<\/a><\/p>\n","protected":false},"author":18825,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[213,93],"tags":[],"_links":{"self":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/40492"}],"collection":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/users\/18825"}],"replies":[{"embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/comments?post=40492"}],"version-history":[{"count":3,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/40492\/revisions"}],"predecessor-version":[{"id":40497,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/posts\/40492\/revisions\/40497"}],"wp:attachment":[{"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/media?parent=40492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/categories?post=40492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.deepin.org.cn\/en\/wp-json\/wp\/v2\/tags?post=40492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Vulnerability details<\/span><\/strong><\/h1>\n
\n
Acquire::Retries<\/code><\/span> is non-zero.<\/span><\/p>\n<\/li>\n<\/ol>\nAffected systems<\/span><\/strong><\/h1>\n
Fix<\/span><\/strong><\/h1>\n
apt<\/code><\/span> has been updated to <\/span>2.8.4deepin1<\/span><\/strong><\/span>, which includes the upstream security update: the download methods now open target files <\/span>exclusively (O_EXCL)<\/span><\/strong><\/span>, so two downloads can no longer share and merge into the same file. Five out-of-bounds access issues are fixed as well:<\/span><\/p>\n\n
deb<\/code><\/span>: guard against unsigned underflow when trimming control newlines;<\/span><\/p>\n<\/li>\ngpgv<\/code><\/span>: do not advance past the null terminator in <\/span>PushEntryWithKeyID<\/code><\/span>;<\/span><\/p>\n<\/li>\ndebDebFileParser<\/code><\/span>: reject <\/span>.deb<\/code><\/span> packages missing a <\/span>Version<\/code><\/span> field;<\/span><\/p>\n<\/li>\nsrvrec<\/code><\/span>: reject <\/span>res_query<\/code><\/span> answers larger than the buffer;<\/span><\/p>\n<\/li>\ntagfile<\/code><\/span>: fix the unbounded backward scan in <\/span>Fill()<\/code><\/span>'s trailing-newline check.<\/span><\/p>\n<\/li>\n<\/ul>\napt --version<\/code><\/span> (expect <\/span>2.8.4deepin1<\/code><\/span>). <\/span>No reboot is required.<\/span><\/strong><\/span><\/p>\n\n
sudo apt -o Acquire::Retries=0 update<\/code><\/span> disables download retries and removes one required condition \u2014 this is a temporary mitigation only and does not replace the update.<\/span><\/p>\n<\/blockquote>\n
\n<\/div>\n