This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-1106 →

DEBIAN-CVE-2018-1106

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages...

Original description

The description as published by the source.

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 packagekit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]

Debian:13 packagekit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]

Debian:14 packagekit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-1"}]}]

References

advisory security-tracker.debian.org