{"id":"UBUNTU-CVE-2020-16121","details":"PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.","modified":"2026-04-22T12:32:03.154340Z","published":"2020-09-24T00:00:00Z","related":["USN-4538-1"],"upstream":["CVE-2020-16121"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2020-16121"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-4538-1"},{"type":"REPORT","url":"https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.html"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2020-16121"}],"affected":[{"package":{"name":"packagekit","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/packagekit@0.8.17-4ubuntu6~gcc5.4ubuntu1.5?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"}]}],"versions":["0.8.17-4ubuntu6~gcc5.3","0.8.17-4ubuntu6~gcc5.4ubuntu1","0.8.17-4ubuntu6~gcc5.4ubuntu1.1","0.8.17-4ubuntu6~gcc5.4ubuntu1.2","0.8.17-4ubuntu6~gcc5.4ubuntu1.3","0.8.17-4ubuntu6~gcc5.4ubuntu1.4"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5","binary_name":"gir1.2-packagekitglib-1.0"},{"binary_name":"gstreamer1.0-packagekit","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"libpackagekit-glib2-16","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"packagekit","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"packagekit-backend-aptcc","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5","binary_name":"packagekit-backend-smart"},{"binary_name":"packagekit-docs","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"packagekit-gtk3-module","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"packagekit-tools","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"},{"binary_name":"python3-packagekit","binary_version":"0.8.17-4ubuntu6~gcc5.4ubuntu1.5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-16121.json"}},{"package":{"name":"packagekit","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/packagekit@1.1.9-1ubuntu2.18.04.6?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.9-1ubuntu2.18.04.6"}]}],"versions":["1.1.7-1","1.1.9-1","1.1.9-1ubuntu1","1.1.9-1ubuntu2","1.1.9-1ubuntu2.18.04.1","1.1.9-1ubuntu2.18.04.3","1.1.9-1ubuntu2.18.04.4","1.1.9-1ubuntu2.18.04.5"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"gir1.2-packagekitglib-1.0","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_version":"1.1.9-1ubuntu2.18.04.6","binary_name":"gstreamer1.0-packagekit"},{"binary_name":"libpackagekit-glib2-18","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_name":"packagekit","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_name":"packagekit-command-not-found","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_name":"packagekit-docs","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_name":"packagekit-gtk3-module","binary_version":"1.1.9-1ubuntu2.18.04.6"},{"binary_name":"packagekit-tools","binary_version":"1.1.9-1ubuntu2.18.04.6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-16121.json"}},{"package":{"name":"packagekit","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/packagekit@1.1.13-2ubuntu1.1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13-2ubuntu1.1"}]}],"versions":["1.1.12-5ubuntu4","1.1.13-1","1.1.13-2","1.1.13-2build1","1.1.13-2ubuntu1"],"ecosystem_specific":{"availability":"No subscription required","binaries":[{"binary_name":"gir1.2-packagekitglib-1.0","binary_version":"1.1.13-2ubuntu1.1"},{"binary_name":"gstreamer1.0-packagekit","binary_version":"1.1.13-2ubuntu1.1"},{"binary_name":"libpackagekit-glib2-18","binary_version":"1.1.13-2ubuntu1.1"},{"binary_name":"packagekit","binary_version":"1.1.13-2ubuntu1.1"},{"binary_version":"1.1.13-2ubuntu1.1","binary_name":"packagekit-command-not-found"},{"binary_name":"packagekit-docs","binary_version":"1.1.13-2ubuntu1.1"},{"binary_name":"packagekit-gtk3-module","binary_version":"1.1.13-2ubuntu1.1"},{"binary_version":"1.1.13-2ubuntu1.1","binary_name":"packagekit-tools"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-16121.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"type":"Ubuntu","score":"low"}]}