ArchLinux: 202106-18: packagekit: information disclosure
Summary
The InstallFiles, GetFilesLocal and GetDetailsLocal methods of the DBus interface to PackageKit <= 1.1.13 access files before checking for authorization. This allows non-privileged users to learn the MIME type of any file on the system.
Resolution
Upgrade to 1.2.3-1.
# pacman -Syu "packagekit>=1.2.3-1"
The problem has been fixed upstream in version 1.2.3.
References
https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887 https://github.com/PackageKit/PackageKit/commit/d5e8c59745bf7c521c6f311e6b22b4b67a8b828f https://security.archlinux.org/CVE-2020-16121
Workaround
None.