CVE-2016-15045CWE-269CWE-306

Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation

High · published July 23, 2025

CVSS v4.0
8.5
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00467 · 39.2th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-306 · Missing Authentication for Critical Function
Published
2025-07-23T13:51Z
EPSS history
Timeline
  • 23 JUL 13:51Z
    Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation
    cvelistv5