#packagekit
LightNews LightNews
cve.skyfleet.blue
CVE-2026-104620 - PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)
CVE ID : CVE-2026-104620

Published : Nov. 9, 2026, 2:31 p.m. | 51 minutes ago

Description : A path traversal attack in simulation of actions in the Zypp backend of PackageKit before...
CVE-2026-104620 - PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)
A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.
cvefeed.io
November 9, 2026 at 3:29 PM
euvd-bot.bsky.social
🚨 EUVD-2026-120864
📊 7.8/10
🏢 packagekit

📝 Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing privilege escalation.

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120864

#cybersecurity #infosec #cve #euvd
November 10, 2026 at 10:00 AM
euvd-bot.bsky.social
🚨 EUVD-2026-120069
📊 8.5/10
🏢 packagekit

📝 A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privile...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120069

#cybersecurity #infosec #cve #euvd
November 9, 2026 at 3:00 PM
arty1f.neocities.org
oh nvm apparently apt doesn't have that in the "install during a reboot" sense like fedora does, and you have to use packagekit. that sucks
October 24, 2026 at 8:00 AM
nixpkgssecuritychanges.gerbet.me
[Backport release-26.05] packagekit: 1.3.5 -> 1.4.0

https://github.com/NixOS/nixpkgs/pull/565189

#security
September 20, 2026 at 1:06 PM
lwn.net.web.brid.gy
Security updates for Thursday
Security updates have been issued by **AlmaLinux** (.NET 10.0, .NET 8.0, .NET 9.0, corosync, firewalld, kernel, kernel-rt, libevent, libsoup, microcode_ctl, nginx:1.26, python-lxml, rsyslog, tesseract, and unbound), **Debian** (firefox-esr, mkvtoolnix, thunderbird, and tor), **Fedora** (open62541, php-pecl-mongodb2, python-django6, python-jwcrypto, and roundcubemail), **Mageia** (aom, cockpit, libgd, packagekit, and python-h2), **Red Hat** (corosync, delve, git-lfs, grafana-pcp, gstreamer1-plugins-base, libvirt, opentelemetry-collector, and rhc-worker-playbook), **Slackware** (mozilla-firefox and mozilla-thunderbird), **SUSE** (acl, attr, alloy, ansible-core, clamav, containerized-data-importer, corosync, cups, distribution, glibc, google-cloud-sap-agent, govulncheck-vulndb, gvfs, helm, jq, kbd, kubernetes1.34-apiserver, kubernetes1.35-apiserver, lcms2, libcupsfilters, liblzmasdk26, libzypp, zypper, mistral-vibe, opensc, openvpn, pcre2, python-jwcrypto, tomcat, tomcat10, and tomcat11), and **Ubuntu** (guix, libheif, perl, python-cryptography, sqlite3, and valkey).
lwn.net
September 17, 2026 at 3:16 PM
neonotu.bsky.social
🟠 HOCH · PackageKit: mehrere Schwachstellen

CERT-Bund (BSI)
PackageKit: mehrere Schwachstellen
CERT-Bund (BSI) meldet mehrere Schwachstellen in PackageKit mit dem Schweregrad hoch. Die vollständige Beschreibung mit betroffenen Versionen und empfohlenen Maßnahmen steht beim CERT-Bund (BSI).
www.neonotu.com
September 10, 2026 at 10:08 PM
mklu.bsky.social
Users of #Fedora / #Arch #Linux and FreeBSD should watch out for #PackageKit updates and update as soon as they are available, to avoid a few security issues.
PackageKit 1.4.0 was just released and resolves a bunch of CVEs/GHSAs.
See lists.freedesktop.org/archives/pac... / github.com/PackageKit/P...
PackageKit 1.4.0 released!
lists.freedesktop.org
September 10, 2026 at 1:00 AM
linuxiac.bsky.social
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned Linux offline update experience.
linuxiac.com/packagekit-2...

#Linux #OpenSource
PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned Linux offline update experience.
linuxiac.com
August 25, 2026 at 3:12 PM
brideoflinux.bsky.social
The update will simplify the code, remove features that aren’t useful on today’s Linux desktops, and add new options for graphical frontends. Some design issues that needed workarounds get better solutions: PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade buff.ly/BxjG0Qi
PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned Linux offline update experience.
linuxiac.com
August 25, 2026 at 8:30 PM
derdreschi84.bsky.social
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned #Linux offline update experience.
PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned Linux offline update experience.
linuxiac.com
August 25, 2026 at 4:29 PM
linuxnews.net
[Linuxiac] PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade

#Linux #OpenSource
PackageKit 2.0 Is Coming with a Complete API Break After More Than a Decade
PackageKit 2.0 is being planned with a complete interface break, major code cleanup, and a redesigned Linux offline update experience.
www.linuxnews.net
August 25, 2026 at 3:30 PM
th3rm.bsky.social
ανενημέρωτο PackageKit;

sudo dnf makecache
pkcon refresh-cache
August 19, 2026 at 9:44 PM
conan-kudo.bsky.social
To celebrate the end of the year, I've completed one of the biggest ticket items I had: I've made a brand new #PackageKit backend for Linux distributions using #DNF version 5.

github.com/PackageKit/P...

If you like this kind of work, please consider sponsoring me!

github.com/sponsors/Con...
Initial implementation of the DNF5 backend by Conan-Kudo · Pull Request #931 · PackageKit/PackageKit
This pull request is the culmination of a few weeks of tons of trial and error to get an initial backend going for DNF version 5. It is as much of a straight port from the existing DNF backend as p...
github.com
December 31, 2025 at 8:45 AM
flipboardbr.flipboard.com.ap.brid.gy
Vulnerabilidade no Linux permitia controle total a qualquer usuário
https://www.tecmundo.com.br/seguranca/412695-vulnerabilidade-no-linux-permitia-controle-total-a-qualquer-usuario.htm?utm_source=flipboard&utm_medium=activitypub

Posted into Tecnologia @tecnologia-FlipboardBR
Vulnerabilidade no Linux permitia controle total a qualquer usuário
Uma vulnerabilidade de alta severidade no PackageKit, camada de gerenciamento de pacotes presente em várias distribuições Linux, permite que qualquer usuário comum instale ou remova pacotes do sistema com permissões de administrador. A falha, chamada de Pack2TheRoot e identificada como CVE-2026-41651 com pontuação CVSS 8.8, explora uma janela entre o momento em que as permissões são verificadas e o momento em que são efetivamente usadas. Nesse intervalo, um atacante consegue substituir os valores e fazer o sistema executar a instalação com suas próprias permissões manipuladas. Todas as versões do PackageKit entre 1.0.2 e 1.3.4 são afetadas, cobrindo mais de 12 anos de lançamentos. Ubuntu, Debian, Fedora e RockyLinux foram confirmados como vulneráveis em instalações padrão. A falha foi descoberta pelo Red Team da Deutsche Telekom com auxílio do modelo Claude Opus e corrigida no PackageKit 1.3.5.
www.tecmundo.com.br
April 27, 2026 at 10:57 PM
aerynos.com
Having appstream working in AerynOS will allow us to further test packagekit as part of our ongoing effort to improve the user experience on AerynOS by making GUI tools available in place of mainly Command Line tooling.
August 20, 2025 at 2:47 PM
aerynos.com
* Working on packagekit integration (Gnome Software and KDE Discover)
* And so much more...

To succeed in building a Linux distribution from scratch, we need our infrastructure and tooling to be a solid foundation for us.
Matrix - Decentralised and secure communication
You're invited to talk on Matrix. If you don't already have a client this link will help you pick one, and join the conversation. If you already have one, this link will help you join the conversation
https://matrix.to/#/#aerynos:matrix.org
August 4, 2025 at 9:42 PM
rootcz.bsky.social
Fedora Asahi Remix 43 vylepšuje balíčkovací systém a podporu hardwaru
Fedora Asahi Remix 43 vylepšuje balíčkovací systém a podporu hardwaru
Vývojáři uvolnili novou verzi distribuce Fedora Asahi Remix 43, která se zaměřuje na běh na počítačích s procesory Apple Silicon. Tato verze obsahuje všechna zajímavá vylepšení, která přinesla Fedora 43. Zejména došlo k významnému vylepšení správy balíčků díky RPM 6.0 a novému backendu DNF5 pro PackageKit v aplikacích Plasma Discover a GNOME Software. Asahi Remix také dále rozšiřuje podporu zařízení, konkrétně pro Mac Pro, mikrofony v MacBoocích M2 Pro/Max a obnovovací frekvenci 120 Hz pro vestavěné displeje modelů MacBook Pro 14/16. Nová verze nabízí jako hlavní desktopové prostředí KDE Plasma 6.6, které obsahuje všechny nové a zajímavé funkce, které přináší Fedora KDE Plasma Desktop 43. Je také vybavena vlastním průvodcem počátečním nastavením založeným na Calamares. K dispozici je také varianta GNOME s GNOME 49. Nabízena je také varianta Fedora Server pro serverové úlohy a jiné typy nasazení bez grafického rozhraní. Nakonec je tu obraz Minimal pro uživatele, kteří si chtějí vytvořit vlastní prostředí od základů.
www.root.cz
March 19, 2026 at 7:15 AM
bzz7t.nekoweb.org
Okay, I boot an Archiso and Arch-chroot

Journalctl says something about a reflector service, disabled that, no dice

I try reinstalling the kernel via pacman, no dice

Noticed something about a packagekit error, reinstall that, no dice

2/3
October 10, 2025 at 5:12 AM
lxer.com.web.brid.gy
How to Hide "PackageKit" Message in openSUSE
Discover how to get rid of the persistent PackageKit message on your openSUSE system and enjoy hassle-free package management without interruptions.
lxer.com
April 21, 2026 at 10:11 PM
wdormann.infosec.exchange.ap.brid.gy
I'll admit that I was surprised that RHEL installed a system-wide app (by way of PackageKit) without asking for credentials.

But this only works for users in the sudo group, so I guess this is only as important as a UAC bypass on Windows (i.e. not important)
test@localhost:~$ git clone https://github.com/vu-ls/tapioca bash: git: command not found... Install package 'git-core' to provide command 'git'? [N/y] y * Waiting in queue... * Loading list of packages.... The following packages have to be installed: git-core-2.47.3-1.el10_0.x86_64 Core package of git with minimal functionality Proceed with changes? [N/y] y * Waiting in queue... * Waiting for authentication... * Waiting in queue... * Loading list of packages.... * Downloading packages... * Requesting data... * Testing changes... * Installing packages... Cloning into 'tapioca'... remote: Enumerating objects: 811, done. remote: Counting objects: 100% (811/811), done. remote: Compressing objects: 100% (344/344), done. remote: Total 811 (delta 484), reused 770 (delta 443), pack-reused 0 (from 0) Receiving objects: 100% (811/811), 510.86 KiB | 7.98 MiB/s, done. Resolving deltas: 100% (484/484), done. test@localhost:~$ sudo ls [sudo] password for test: sudo: a password is required test@localhost:~$ which git /usr/bin/git test@localhost:~$
May 1, 2026 at 3:10 PM
bleepingcomputer.com.web.brid.gy
New ‘Pack2TheRoot’ flaw gives hackers root Linux access
A new vulnerability dubbed Pack2TheRoot could be exploited in the PackageKit daemon to allow local Linux users to install or remove system packages and gain root permissions. [...]
www.bleepingcomputer.com
April 25, 2026 at 6:01 AM
venezuelanewschepa.bsky.social
Open-source developer Matthias Klumpp introduced pkgcli, a modern command-line interface for PackageKit, aiming to provide a more user-friendly and efficient package management experience.

https://www.phoronix.com/news/PackageKit-pkgcli
June 14, 2026 at 1:43 PM
venezuelanewschepa.bsky.social
Primero: El desarrollador de código abierto Matthias Klumpp presentó pkgcli, una nueva interfaz de línea de comandos moderna para PackageKit, que mejora la experiencia de gestión de paquetes. Este proyecto busca ofrecer una alternativa más amigable y eficiente a las herramientas ex...
June 14, 2026 at 1:43 PM
it-connect.bsky.social
⚠️ Pack2TheRoot

Une faille vieille de 12 ans a été patchée dans un composant utilisé par de nombreux Linux : PackageKit.

Par exemple, la faille est exploitable sur Debian 13.4 et Fedora 43.

Plus d'infos 👇
- www.it-connect.fr/pack2theroot...

#linux #infosec #cybersecurite
April 27, 2026 at 8:29 AM