CVE-2018-1106

CVE-2018-1106 affects PackageKit prior to 1.1.10. The vulnerability is an authentication bypass that allows a non-administrative user to install signed packages, enabling local privilege escalation and potential system compromise by installing vulnerable packages. Public advisories (various OS ve...

CVE-2024-0217

CVE-2024-0217 overview (concrete details from connected docs): A use-after-free in PackageKitd can cause a memory access to regions freed during transaction cleanup, with freed regions potentially reused for new allocations. This vulnerability is reported across multiple distributions and advisor...

CVE-2022-0987

CVE-2022-0987 concerns a timing side-channel in PackageKit’s Transaction interface. Some methods expose timing information, allowing a local user to infer the existence of files owned by root or other users. Impact is information disclosure with local access; CVSS values in the records show LOW s...