CVE-2020-16121

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
PackageKit	PackageKit	>= 1.1.13-2ubuntu, < 1.1.13-2ubuntu1.1; >= 1.1.9-1ubuntu2, < 1.1.9-1ubuntu2.18.04.6; >= 0.8.17-4ubuntu6, < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5

References

https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887Issue Tracking, Third Party Advisory
https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.htmlExploit, Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887Issue Tracking, Third Party Advisory
https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.htmlExploit, Third Party Advisory

Timeline

Published: Nov 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-161227.8PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the co CVE-2020-161234.7An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from CVE-2020-161249.8Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated CVE-2020-161256.8gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely CVE-2020-161263.3An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped t CVE-2020-161275.5An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unboun CVE-2020-161283.8The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-20 CVE-2020-16137.5A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon CVE-2020-161316.1Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.CVE-2020-161348.0An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.0 CVE-2020-161355.9libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.CVE-2020-161367.7In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (acc