CVE-2020-15709: 
Linux Debian vulnerability analysis and mitigation

A vulnerability was discovered in add-apt-repository versions before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, where the software incorrectly handled PPA (personal package archive) descriptions. The issue was discovered by Jason A. Donenfeld and was disclosed on August 3, 2020. The vulnerability affects Ubuntu systems running Software Properties package (Ubuntu Security).

The vulnerability stems from the software's failure to properly filter ANSI terminal escape sequences when displaying PPA descriptions. The issue has been assigned a CVSS 3.1 base score of 5.5 (Medium), with the following characteristics: Local attack vector, Low attack complexity, Low privileges required, No user interaction needed, Unchanged scope, No impact on confidentiality, High integrity impact, and No impact on availability (Ubuntu Security).

If exploited, this vulnerability could allow PPA owners to provide ANSI terminal escapes that could modify terminal contents in unexpected ways. The primary impact is on system integrity, with no direct effect on confidentiality or availability (Ubuntu Security).

The vulnerability requires local access and low privileges to exploit. An attacker would need to trick a user into adding an arbitrary PPA, at which point they could potentially manipulate the screen display (Ubuntu Security Notice).

The vulnerability has been fixed in multiple Ubuntu versions with the following package updates: Ubuntu 20.04 LTS (0.98.9.2), Ubuntu 18.04 LTS (0.96.24.32.14), Ubuntu 16.04 LTS (0.96.20.10), and Ubuntu 14.04 LTS (0.92.37.8ubuntu0.1~esm1). Users are advised to update their systems to these versions through standard system updates (Ubuntu Security).