CVE-2013-1764

2014-04-1618:37:12

CWE-264

[email protected]

web.nvd.nist.gov

zypper

packagekit

downgrade

cve-2013-1764

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the “install updates” method.

Affected configurations

NVD

Node

packagekit_projectpackagekitRange≤0.8.7

packagekit_projectpackagekitMatch0.8.1

packagekit_projectpackagekitMatch0.8.2

packagekit_projectpackagekitMatch0.8.3

packagekit_projectpackagekitMatch0.8.4

packagekit_projectpackagekitMatch0.8.5

packagekit_projectpackagekitMatch0.8.6

CPENameOperatorVersion
packagekit_project:packagekitpackagekit project packagekitle0.8.7
packagekit_project:packagekitpackagekit project packagekiteq0.8.1
packagekit_project:packagekitpackagekit project packagekiteq0.8.2
packagekit_project:packagekitpackagekit project packagekiteq0.8.3
packagekit_project:packagekitpackagekit project packagekiteq0.8.4
packagekit_project:packagekitpackagekit project packagekiteq0.8.5
packagekit_project:packagekitpackagekit project packagekiteq0.8.6

CPE	Name	Operator	Version
packagekit_project:packagekit	packagekit project packagekit	le	0.8.7
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.1
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.2
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.3
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.4
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.5
packagekit_project:packagekit	packagekit project packagekit	eq	0.8.6