CVE-2022-0987
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction...
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
CVE-2022-0987- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
CVE-2022-0987- Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2022-15981 No score
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
EUVD-2022-15981- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cxr3-mmp5-f58q
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction...
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
GHSA-cxr3-mmp5-f58q- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
CVE-2022-0987- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-0987
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
DEBIAN-CVE-2022-0987- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-0987
A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
- Record
UBUNTU-CVE-2022-0987- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
packagekitDebian:12 |
All versions, plus listed versions 1.2.6-51.2.6-5+deb12u11.2.7-11.2.8-11.2.8-2 Show 11 moreShow less1.3.0-11.3.0-21.3.0-31.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:13 |
All versions, plus listed versions 1.3.1-11.3.1-1+deb13u11.3.2-11.3.3-11.3.4-1 Show 4 moreShow less1.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitDebian:14 |
All versions, plus listed versions 1.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.5-11.3.6-11.4.0-1 |
None known |
packagekitUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 0.8.17-4ubuntu6~gcc5.30.8.17-4ubuntu6~gcc5.4ubuntu10.8.17-4ubuntu6~gcc5.4ubuntu1.10.8.17-4ubuntu6~gcc5.4ubuntu1.20.8.17-4ubuntu6~gcc5.4ubuntu1.30.8.17-4ubuntu6~gcc5.4ubuntu1.40.8.17-4ubuntu6~gcc5.4ubuntu1.50.8.17-4ubuntu6~gcc5.4ubuntu1.5+esm1 |
None known |
packagekitUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.1.7-11.1.9-11.1.9-1ubuntu11.1.9-1ubuntu21.1.9-1ubuntu2.18.04.1 Show 5 moreShow less1.1.9-1ubuntu2.18.04.31.1.9-1ubuntu2.18.04.41.1.9-1ubuntu2.18.04.51.1.9-1ubuntu2.18.04.61.1.9-1ubuntu2.18.04.6+esm1 |
None known |
packagekitUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.1.12-5ubuntu41.1.13-11.1.13-21.1.13-2build11.1.13-2ubuntu11.1.13-2ubuntu1.11.1.13-2ubuntu1.1+esm1 |
None known |
packagekitUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.2-2ubuntu31.2.4-1ubuntu11.2.4-1ubuntu21.2.5-1ubuntu11.2.5-2ubuntu11.2.5-2ubuntu21.2.5-2ubuntu31.2.5-2ubuntu3.1 |
None known |
packagekitUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.7-11.2.8-11.2.8-1build11.2.8-21.2.8-2build2 Show 6 moreShow less1.2.8-2build31.2.8-2ubuntu11.2.8-2ubuntu1.11.2.8-2ubuntu1.21.2.8-2ubuntu1.41.2.8-2ubuntu1.5 |
None known |
packagekitUbuntu:25.10 |
All versions, plus listed versions 1.3.0-3build11.3.1-11.3.1-1ubuntu11.3.1-1ubuntu1.1 |
None known |
packagekitUbuntu:26.10 |
All versions, plus listed versions 1.3.4-31.3.5-11.3.5-1ubuntu11.3.6-11.3.6-1ubuntu1 |
None known |
packagekitUbuntu:26.04:LTS |
All versions, plus listed versions 1.3.1-11.3.2-11.3.3-11.3.4-11.3.4-31.3.4-3ubuntu11.3.4-3ubuntu1.11.3.4-3ubuntu1.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0987 is a low vulnerability (CVSS 3.3) in Packagekit, published June 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 18th percentile. No source names a fixed version.