FYI, if you are on Debian and have daily updates on(unattended-upgrades is your friend) you most likely already have the patch it came out yesterday.

Is Hannah Montana Linux safe?

The vulnerability exists in the HTTP backend invoked by the APT library, and affects any APT-based frontend (apt, apt-get, aptitude, or any of the Ubuntu graphical applications).

The use of TLS via HTTPS protects against this vulnerability, as exploitation requires the attacker to manipulate HTTP traffic.

What a fucking surprise. They've been trying to justify using HTTP for apt repositories with the excuse "but every package is signed by GPG." Well guess what, fuckers! WE FUCKING TOLD YOU SO!

Some more... hypertense individuals might see all these recent news and think Linux as super flawed. I'd think otherwise, Linux is becoming popular and so it gets a lot of new QA (though how it's reported from what I see feels mishandled).

I'm kinda surprised apt even allows http without a flag or config change.