Ludwig Nussel reported during testing that "update" can downgrade packages, while we would expect it can only upgrade packages. In openSUSE we allow "update" for the logged in desktop user, so a local attacker could use this to install a previously fixed package with security problems and so potentially be able to exploit this older issue. The expectation would be that "downgrading" would require ewither install or similar privileges.
Created attachment 75253 [details] commandline log of the update that downgraded packages commandline log of the update that downgraded packages
PackageKit doesn't do any validation on the package numbers to ensure they "go up" but it's an expected thing of the backend to ensure the packages don't get downgraded.
This has been fixed in PackageKit's Zypper backend: http://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.