Description
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
References
- [oss-security] 20130225 Re: CVE Request: PackageKit"update" allows downgrade of packages when using the "zypp" backend mailing-list
- https://gitorious.org/packagekit/packagekit/source/NEWS
- https://bugs.freedesktop.org/show_bug.cgi?id=61231
- openSUSE-SU-2013:0889 vendor-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=804983
- https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425