Summary
[1.1.10-2.0.3]
- Backport fix for CVE-2026-41651 [Orabug: 39467887]
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | PackageKit | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-command-not-found | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-cron | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-glib | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-glib-devel | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-gstreamer-plugin | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-gtk3-module | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-yum | 0:1.1.10-2.0.3.el7 |
| Oracle Linux · 7 | PackageKit-yum-plugin | 0:1.1.10-2.0.3.el7 |
Vulnerabilities 1
-
High 8.8CVE-2026-41651 Public exploit
PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as root
PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro, cross-architecture API. PackageKit between and including versions 1.0.2 and 1.3.4 is vulnerable to a time-of-check time-of-use (TOCTOU) rac…