Versions mentioned in the description apply to the upstream
Remediation section below for
Debian:9 relevant versions.
The changelog command in Apt before 220.127.116.11 allows local users to write to arbitrary files via a symlink attack on the changelog file.
apt to version 18.104.22.168 or higher.