Unscored severity · published Apr 16, 2014
CVE-2013-1764
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method
–
CVSS
0.4%
EPSS
No
On KEV
Description
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Packagekit · Packagekit Project
through 0.8.7; 0.8.1; 0.8.2; 0.8.3; 0.8.4; 0.8.5; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1764
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1764
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-06/msg00026.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/02/25/20
Patch
https://bugs.freedesktop.org/show_bug.cgi?id=61231
bugzilla.novell.com
https://bugzilla.novell.com/show_bug.cgi?id=804983
gitorious.org
https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425
Vendor Advisory
https://gitorious.org/packagekit/packagekit/source/NEWS
More from Packagekit
8.8
CVE-2026-41651
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
7.8
CVE-2020-16122
PackageKit's apt backend mistakenly treated all local debs as trusted
5.5
CVE-2018-1106
An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages
5.3
CVE-2011-2515
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code
3.3
CVE-2024-0217
A use-after-free flaw was found in PackageKitd