CVE-2020-16122

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269CWE-345

Affected software

VendorProductVersions
PackageKitpackagekit>= 1.1.13-2ubuntu, < 1.1.13-2ubuntu1.1; >= 1.1.9-1ubuntu, < 1.1.9-1ubuntu2.18.04.6; >= 0.8.17-4ubuntu, < 0.8.17-4ubuntu6~gcc5.4ubuntu1.5

References

Timeline

Published
Nov 7, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-161234.7An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection fromCVE-2020-161249.8Integer Overflow or Wraparound vulnerability in the XML RPC library of OpenRobotics ros_comm communications packages allows unauthenticated CVE-2020-161256.8gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely CVE-2020-161263.3An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped tCVE-2020-161275.5An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounCVE-2020-161283.8The aptdaemon DBus interface disclosed file existence disclosure by setting Terminal/DebconfSocket properties, aka GHSL-2020-192 and GHSL-20CVE-2020-16137.5A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session uponCVE-2020-161316.1Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.CVE-2020-161348.0An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.0CVE-2020-161355.9libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.CVE-2020-161367.7In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine (accCVE-2020-161379.8A privilege escalation issue in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers to reset the credentials