Every CVE Search/ Get API key

CVE-2018-1106

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users...

5.5 MediumFix available

CVE-2018-1106 is a medium vulnerability (CVSS 5.5) in Packagekit, published April 23, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in packagekit 1.1.10-1.

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.38%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
CVE-2018-1106
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-287
Updated
2026-11-02
CVE List No score

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
CVE-2018-1106
Weakness
CWE-287
Updated
2026-11-02
EUVDEUVD-2018-11753 No score

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
EUVD-2018-11753
Updated
2026-11-03
GitHub AdvisoriesGHSA-9pvg-w7xf-pgq7 5.5

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users...

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
GHSA-9pvg-w7xf-pgq7
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-287
Updated
2026-11-02
OSV 5.5

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
CVE-2018-1106
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1106 5.5

An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages. A local attacker can use this vulnerability to install vulnerable packages to further compromise a system.

Record
DEBIAN-CVE-2018-1106
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVRHSA-2018:1224 5.5

Red Hat Security Advisory: PackageKit security update

Record
RHSA-2018:1224
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:10605-1 No score

PackageKit-1.2.2-13.2 on GA media

These are all security issues fixed in the PackageKit-1.2.2-13.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10605-1
Updated
2026-11-02
OSVSUSE-SU-2018:1047-1 No score

Security update for PackageKit

  • CVE-2018-1106: Drop the polkit rule which could allow users in wheel group to install packages without root password (bsc#1086936).
Record
SUSE-SU-2018:1047-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
packagekit
Debian:12
 before 1.1.10-1
1.1.10-1
packagekit
Debian:13
 before 1.1.10-1
1.1.10-1
packagekit
Debian:14
 before 1.1.10-1
1.1.10-1
packagekit
Debian:9
 before 1.1.5-2+deb9u1, plus listed versions
1.1.5-2
1.1.5-2+deb9u1
PackageKit
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-command-not-found
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gstreamer-plugin
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gtk3-module
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
Show 40 moreShow less
Affected packages
PackageAffectedFixed
PackageKit-yum
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-cron
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib-devel
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum-plugin
Red Hat:enterprise_linux:7::client
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-command-not-found
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-cron
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gstreamer-plugin
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gtk3-module
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum-plugin
Red Hat:enterprise_linux:7::computenode
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-command-not-found
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gstreamer-plugin
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gtk3-module
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-cron
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib-devel
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum-plugin
Red Hat:enterprise_linux:7::server
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-command-not-found
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gstreamer-plugin
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-gtk3-module
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-cron
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-glib-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit-yum-plugin
Red Hat:enterprise_linux:7::workstation
 before 0:1.1.5-2.el7_5
0:1.1.5-2.el7_5
PackageKit
SUSE:Linux Enterprise Desktop 12 SP3
 before 1.1.3-24.6.1
1.1.3-24.6.1
PackageKit
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 1.1.3-24.6.1
1.1.3-24.6.1
PackageKit
SUSE:Linux Enterprise Server 12 SP3
 before 1.1.3-24.6.1
1.1.3-24.6.1
PackageKit
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.1.3-24.6.1
1.1.3-24.6.1
PackageKit
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 1.1.3-24.6.1
1.1.3-24.6.1
PackageKit
openSUSE:Tumbleweed
 before 1.2.2-13.2
1.2.2-13.2

History

History
WhenChangedSources
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open