Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 20.04 LTS: USN-4538-1 Critical: PackageKit Local Attacks

ubuntu
Calendar Grey September 24, 2020
Dist Ubuntu Esm H88
Several security flaws have been addressed in PackageKit impacting several Ubuntu LTS versions. Ensure your system is updated for enhanced protection.
Several security issues were fixed in PackageKit.

Summary

Several security issues were fixed in PackageKit.

Software Description:

- packagekit: Provides a package management service

Details:

Vaisha Bernard discovered that PackageKit incorrectly handled certain

methods. A local attacker could use this issue to learn the MIME type of

any file on the system. (CVE-2020-16121)

Sami Niemimäki discovered that PackageKit incorrectly handled local deb

packages. A local user could possibly use this issue to install untrusted

packages, contrary to expectations. (CVE-2020-16122)

Topics%20covered

Topics Covered

security advisory software update threat local attack ubuntu system security packagekit

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  packagekit                      1.1.13-2ubuntu1.1

Ubuntu 18.04 LTS:
  packagekit                      1.1.9-1ubuntu2.18.04.6

Ubuntu 16.04 LTS:
  packagekit                      0.8.17-4ubuntu6~gcc5.4ubuntu1.5

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

https://ubuntu.com/security/notices/USN-4538-1

CVE-2020-16121, CVE-2020-16122

Severity
critical
Lowest
Low
Medium
High
Critical

September 24, 2020

Topics%20covered

Topics Covered

security advisory software update threat local attack ubuntu system security packagekit

Package Information

https://launchpad.net/ubuntu/+source/packagekit/1.1.13-2ubuntu1.1
https://launchpad.net/ubuntu/+source/packagekit/1.1.9-1ubuntu2.18.04.6
https://launchpad.net/ubuntu/+source/packagekit/0.8.17-4ubuntu6~gcc5.4ubuntu1.5

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here