汇总 packagekit_project 相关全部产品的 CVE 与安全漏洞情报，包括 CVSS、EPSS、公开时间与漏洞情报数据。
常见弱点模式包括 路径处理缺陷与内存损坏，在 生产负载与软件部署 使用场景中可能带来 文件覆盖、内存损坏与应用崩溃 等风险。
相关漏洞数据主要来源于公开漏洞披露与安全公告，可用于评估历史漏洞暴露面与修复优先级。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2026-41651 | PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition on transaction flags that allows unprivileged users to install packages as root and thus leads to a local privilege escalation. This is patched in version 1.3.5. A local unprivileged user can install arbitrary RPM packages as ro | [email protected] | 8.8 | 0.41% | 2026-04-22 | 2026-06-17 |
| CVE-2024-0217 | A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted. As a result, some memory access could occur on memory regions that were previously freed. Once freed, a memory region can be reused for other allocations and any previously stored data in this memory region is considered lost. | [email protected] | 3.3 | 0.23% | 2024-01-03 | 2026-06-17 |
| CVE-2022-0987 | A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists. | [email protected] | 3.3 | 0.25% | 2022-06-28 | 2026-06-17 |
| CVE-2020-16122 | PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages. | [email protected] | 8.2 | 0.34% | 2020-11-07 | 2026-06-17 |
| CVE-2020-16121 | PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own. | [email protected] | 3.3 | 0.46% | 2020-11-07 | 2026-06-17 |
| CVE-2011-2515 | PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code. | [email protected] | 5.3 | 0.39% | 2019-11-27 | 2026-06-16 |
| CVE-2018-1106 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system. | [email protected] | 5.5 | 0.39% | 2018-04-23 | 2026-06-17 |
| CVE-2013-1764 | The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method. | [email protected] | 2.1 | 0.38% | 2014-04-16 | 2026-06-16 |