CVE-2020-16122

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages.

• CWE-269
• CWE-345

• https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098Issue Tracking, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1882098Issue Tracking, Third Party Advisory

Published

Nov 7, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-16116In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted a…3.3
• CVE-2020-16117In GNOME evolution-data-server before 3.35.91, a malicious s…5.9
• CVE-2020-16118In GNOME Balsa before 2.6.0, a malicious server operator or …7.5
• CVE-2020-16119Use-after-free vulnerability in the Linux kernel exploitable…7.8
• CVE-2020-16120Overlayfs did not properly perform permission checking when …4.4
• CVE-2020-16121PackageKit provided detailed error messages to unprivileged …3.3
• CVE-2020-16123An Ubuntu-specific patch in PulseAudio created a race condit…4.7
• CVE-2020-16124Integer Overflow or Wraparound vulnerability in the XML RPC …9.8
• CVE-2020-16125gdm3 versions before 3.36.2 or 3.38.2 would start gnome-init…6.8
• CVE-2020-16126An Ubuntu-specific modification to AccountsService in versio…3.3
• CVE-2020-16127An Ubuntu-specific modification to AccountsService in versio…5.5
• CVE-2020-16128The aptdaemon DBus interface disclosed file existence disclo…3.8