CVE-2013-1764: Low severity Packagekit Project Packagekit vulnerability
Published Apr 16, 2014
·Updated
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
Affected Software
7 affected components
Packagekit Project Packagekit<=0.8.7
Packagekit Project Packagekit=0.8.1
Packagekit Project Packagekit=0.8.2
Packagekit Project Packagekit=0.8.3
Packagekit Project Packagekit=0.8.4
Packagekit Project Packagekit=0.8.5
Packagekit Project Packagekit=0.8.6
Remediation
Patch Available
Event History
Apr 16, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:37 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-1764?
CVE-2013-1764 has been assigned a medium severity level due to the potential for local users to downgrade packages.
2
How do I fix CVE-2013-1764?
To fix CVE-2013-1764, upgrade PackageKit to version 0.8.8 or later.
3
Who is affected by CVE-2013-1764?
Users of PackageKit versions 0.8.7 and earlier are affected by CVE-2013-1764.
4
What type of vulnerability is CVE-2013-1764?
CVE-2013-1764 is a local privilege escalation vulnerability related to package downgrading.
5
Can CVE-2013-1764 be exploited remotely?
CVE-2013-1764 cannot be exploited remotely as it requires local access to the system.