Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.3470
packagekit security update
8 October 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: packagekit
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Increased Privileges -- Existing Account
Reduced Security -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2020-16122 CVE-2020-16121
Reference: ESB-2020.3292
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2020/10/msg00011.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2399-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Roberto C. Sanchez
October 07, 2020 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : packagekit
Version : 1.1.5-2+deb9u2
CVE ID : CVE-2020-16121 CVE-2020-16122
Two vulnerabilities have been discovered in packagekit, a package
management service.
CVE-2020-16121
Vaisha Bernard discovered that PackageKit incorrectly handled
certain methods. A local attacker could use this issue to learn the
MIME type of any file on the system.
CVE-2020-16122
Sami Niemim=E4ki discovered that PackageKit incorrectly handled local
deb packages. A local user could possibly use this issue to install
untrusted packages, contrary to expectations.
For Debian 9 stretch, these problems have been fixed in version
1.1.5-2+deb9u2.
We recommend that you upgrade your packagekit packages.
For the detailed security status of packagekit please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/packagekit
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBX35YFONLKJtyKPYoAQisAg/8D/18RO/SdT0OS+Dh/oaAr0+PMvXiqfRq
H5fQfwb+CTouS76+RXMTPOuknm/lnkA2oY3oAwhipC1WZBh3fn7prV9OdXUZ6aTl
yWkaJPPH/080pq7ja/R66RJgMCY6y09NTXkim9vOoJVMfbS3+XAIwUGh2YcwjMeX
3VMO9pgvx4k1owLvnexpIyJWnQGghdhPi5lt2iDyFhJNsDzODoAokevJ3ZupWQya
hIxZg9LnYnQhiPDjUxN4G5fWQHQJe36bQskIyUU2d9CBaHuSzke7vTzC4JxZejB5
Q7WdP3cqCLxh2wh77rvqX1Tfj3NxPNbI0KYvWN6kwG1tnD390wT4kQWdIm54YvGi
IXvY8X9VPpH51kylbHjZ9Do1GUASsKl0eGil1HChyk56avuuFWfqDM08PEQnEwgk
31YehuVNsr8zOeDv/8rOf8DPxP8BAS2hheWDK68ZXflCaOwHgRkIJgQbOF4Z6Li3
XPftdI/YGoYH0J9rdaM65DexRngoM3BoOD5vGR65ebPsAc1FhOeB9q9bp+ZJwI6f
kx6LISxIahHPcUTrYmcPE2vMeuYVxX8JCLM6UC2/VkfB8SUUtSZ2LecEoIXnWK1k
vS7K/RIOz4cDlsDeVOO5HRlao3UICSjf41PaPIl+UmPFP8IwX6DrJeDII7N6Q62a
UWWriZJMs6k=
=CmEj
-----END PGP SIGNATURE-----