EUVD-2016-6378

Malware in sbrugna...

pacman command injection vulnerability

pacman is a package manager used in Linux. A command injection vulnerability exists in the 'applydeltas' function in the lib/libalpm/sync.c file in pacman versions prior to 5.2. The vulnerability stems from a network system or product not properly filtering special elements of external input data...

Command injection

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

CVE-2019-18183

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

CVE-2019-18183

CVE-2019-18183 affects pacman and its libalpm/sync.c apply_deltas() in the delta processing path. The vulnerability exists when unsigned databases are used and the non-default delta feature is enabled, allowing an attacker-controlled crafted database and delta file to inject arbitrary commands. T...

PT-2020-9942

Name of the Vulnerable Software and Affected Versions pacman versions prior to 5.2 Description The issue allows for arbitrary command injection in the apply deltas function, located in lib/libalpm/sync.c. This can be exploited when unsigned databases are used, and the user has enabled the...

CVE-2019-18183: Improper Neutralization of Special Elements used in an OS Command

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

CVE-2019-9686

CVE-2019-9686 affects pacman before 5.1.3. The issue arises when installing a remote package via a URL (pacman -U ): the unsanitized Content-Disposition filename can contain slashes and is used in rename(), enabling a remote attacker to place the file anywhere in the filesystem and potentially ac...

CVE-2019-9686

pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U " due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not...

PT-2019-19796

Name of the Vulnerable Software and Affected Versions pacman versions prior to 5.1.3 Description The issue allows directory traversal when installing a remote package via a specified URL, due to an unsanitized file name received from a Content-Disposition header. This can lead to arbitrary root...

CVE-2016-5434

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

Out-of-bounds

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

CVE-2016-5434

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

CVE-2016-5434

The CVE-2016-5434 issue affects libalpm, as used by pacman 5.0.1. It allows a crafted signature file to trigger a denial of service via an infinite loop or out-of-bounds read. Root cause: improper handling in signature processing within libalpm. Impact: denial of service with potential unavailabi...

CVE-2016-5434: Out-of-bounds Read

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...