CVE-2020-16121
PackageKit error messages leak presence and mimetype of files to unprivileged users
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PackageKit error messages leak presence and mimetype of files to unprivileged users
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
CVE-2020-16121- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2020-8087
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
EUVD-2020-8087- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6g23-6jw5-9vrf No score
PackageKit provided detailed error messages to unprivileged callers that exposed information...
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
GHSA-6g23-6jw5-9vrf- Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
CVE-2020-16121- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
CVE-2020-16121- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-16121
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
DEBIAN-CVE-2020-16121- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2021-1381
PackageKit security update
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API.
Security Fix(es):
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.(CVE-2020-16121)
- Record
OESA-2021-1381- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-16121
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
- Record
UBUNTU-CVE-2020-16121- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0415 No score
Updated packagekit packages fix a security vulnerability
It was discovered that packagekit was subject to a vulnerability where the InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit accesses given files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the system. (CVE-2020-16121)
- Record
MGASA-2020-0415- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2292-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issue:
- CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930).
- Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. (bsc#1169739)
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:2292-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:2344-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issue:
- CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930).
- Update summary and description of gstreamer-plugin and gtk3-module. (bsc#1104313)
This update was imported from the SUSE:SLE-15-SP2:Update update project.
- Record
openSUSE-SU-2020:2344-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10605-1 No score
PackageKit-1.2.2-13.2 on GA media
These are all security issues fixed in the PackageKit-1.2.2-13.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10605-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3845-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issue:
- CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930).
- Notify service manager when it shutdown and cleanup temporary files when PackageKit quits. (bsc#1169739)
- Record
SUSE-SU-2020:3845-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3909-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issues:
- CVE-2020-16121: Fixed an information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930).
- Record
SUSE-SU-2020:3909-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:3911-1 No score
Security update for PackageKit
This update for PackageKit fixes the following issue:
- CVE-2020-16121: Fixed an Information disclosure in InstallFiles, GetFilesLocal and GetDetailsLocal (bsc#1176930).
- Update summary and description of gstreamer-plugin and gtk3-module. (bsc#1104313)
- Record
SUSE-SU-2020:3911-1- Updated
- 2026-11-02
OSVUSN-4538-1 No score
packagekit vulnerabilities
Vaisha Bernard discovered that PackageKit incorrectly handled certain methods. A local attacker could use this issue to learn the MIME type of any file on the system. (CVE-2020-16121)
Sami Niemimäki discovered that PackageKit incorrectly handled local deb packages. A local user could possibly use this issue to install untrusted packages, contrary to expectations. (CVE-2020-16122)
- Record
USN-4538-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
packagekitDebian:12 |
before 1.2.1-1 | 1.2.1-1 |
packagekitDebian:13 |
before 1.2.1-1 | 1.2.1-1 |
packagekitDebian:14 |
before 1.2.1-1 | 1.2.1-1 |
packagekitDebian:9 From an advisory covering 2 CVEs |
before 1.1.5-2+deb9u2, plus listed versions 1.1.5-21.1.5-2+deb9u1 |
1.1.5-2+deb9u2 |
packagekitMageia:7 |
before 1.1.12-3.1.mga7 | 1.1.12-3.1.mga7 |
PackageKitopenEuler:20.03-LTS-SP1 |
before 1.1.12-10.oe1 | 1.1.12-10.oe1 |
PackageKitopenEuler:20.03-LTS-SP2 |
before 1.1.12-10.oe1 | 1.1.12-10.oe1 |
PackageKitSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 1.1.10-12.10.1 | 1.1.10-12.10.1 |
PackageKitSUSE:Linux Enterprise Workstation Extension 15 SP1 |
before 1.1.10-12.10.1 | 1.1.10-12.10.1 |
PackageKitSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.1.3-24.15.1 | 1.1.3-24.15.1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
PackageKitSUSE:Linux Enterprise Server 12 SP5 |
before 1.1.3-24.15.1 | 1.1.3-24.15.1 |
PackageKitSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.1.3-24.15.1 | 1.1.3-24.15.1 |
PackageKitSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 1.1.3-24.15.1 | 1.1.3-24.15.1 |
PackageKitSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 |
before 1.1.13-4.14.2 | 1.1.13-4.14.2 |
PackageKitSUSE:Linux Enterprise Workstation Extension 15 SP2 |
before 1.1.13-4.14.2 | 1.1.13-4.14.2 |
packagekitUbuntu:16.04:LTS |
before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5, plus listed versions 0.8.17-4ubuntu6~gcc5.30.8.17-4ubuntu6~gcc5.4ubuntu10.8.17-4ubuntu6~gcc5.4ubuntu1.10.8.17-4ubuntu6~gcc5.4ubuntu1.20.8.17-4ubuntu6~gcc5.4ubuntu1.30.8.17-4ubuntu6~gcc5.4ubuntu1.4 |
0.8.17-4ubuntu6~gcc5.4ubuntu1.5 |
packagekitUbuntu:18.04:LTS |
before 1.1.9-1ubuntu2.18.04.6, plus listed versions 1.1.7-11.1.9-11.1.9-1ubuntu11.1.9-1ubuntu21.1.9-1ubuntu2.18.04.11.1.9-1ubuntu2.18.04.31.1.9-1ubuntu2.18.04.41.1.9-1ubuntu2.18.04.5 |
1.1.9-1ubuntu2.18.04.6 |
packagekitUbuntu:20.04:LTS |
before 1.1.13-2ubuntu1.1, plus listed versions 1.1.12-5ubuntu41.1.13-11.1.13-21.1.13-2build11.1.13-2ubuntu1 |
1.1.13-2ubuntu1.1 |
packagekitUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 0.8.17-4ubuntu6~gcc5.4ubuntu1.5, plus listed versions 0.8.17-4ubuntu6~gcc5.30.8.17-4ubuntu6~gcc5.4ubuntu10.8.17-4ubuntu6~gcc5.4ubuntu1.10.8.17-4ubuntu6~gcc5.4ubuntu1.20.8.17-4ubuntu6~gcc5.4ubuntu1.30.8.17-4ubuntu6~gcc5.4ubuntu1.4 |
0.8.17-4ubuntu6~gcc5.4ubuntu1.5 |
packagekitUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1.1.9-1ubuntu2.18.04.6, plus listed versions 1.1.7-11.1.9-11.1.9-1ubuntu11.1.9-1ubuntu21.1.9-1ubuntu2.18.04.11.1.9-1ubuntu2.18.04.31.1.9-1ubuntu2.18.04.41.1.9-1ubuntu2.18.04.5 |
1.1.9-1ubuntu2.18.04.6 |
packagekitUbuntu:20.04:LTS From an advisory covering 2 CVEs |
before 1.1.13-2ubuntu1.1, plus listed versions 1.1.12-5ubuntu41.1.13-11.1.13-21.1.13-2build11.1.13-2ubuntu1 |
1.1.13-2ubuntu1.1 |
PackageKitopenSUSE:Leap 15.1 |
before 1.1.10-lp151.8.12.1 | 1.1.10-lp151.8.12.1 |
PackageKitopenSUSE:Leap 15.2 |
before 1.1.13-lp152.3.15.1 | 1.1.13-lp152.3.15.1 |
PackageKitopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.2.2-13.2 | 1.2.2-13.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-16121 is a low vulnerability (CVSS 3.3) in Packagekit, published September 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in packagekit 1.2.1-1.
References
eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html
bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887
nvd.nist.gov/vuln/detail/CVE-2020-16121
github.com/advisories/GHSA-6g23-6jw5-9vrf
security-tracker.debian.org/tracker/CVE-2020-16121
advisories.mageia.org/MGASA-2020-0415.html
Show 17 moreShow less
bugs.mageia.org/show_bug.cgi?id=27321
ubuntu.com/security/notices/USN-4538-1
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1381
suse.com/support/update/announcement/2020/suse-su-20203845-1
bugzilla.suse.com/1169739
cve.org/CVERecord?id=CVE-2020-16121
lists.opensuse.org/archives/list/[email protected]/thread/CMDG3TCU5LRAC7S5OQFWQ2ZCJ6MQPUSX