EUVD-2016-6378

Malware in sbrugna...

pacman command injection vulnerability

pacman is a package manager used in Linux. A command injection vulnerability exists in the 'applydeltas' function in the lib/libalpm/sync.c file in pacman versions prior to 5.2. The vulnerability stems from a network system or product not properly filtering special elements of external input data...

Command injection

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

CVE-2019-18183

CVE-2019-18183 affects pacman and its libalpm/sync.c apply_deltas() in the delta processing path. The vulnerability exists when unsigned databases are used and the non-default delta feature is enabled, allowing an attacker-controlled crafted database and delta file to inject arbitrary commands. T...

CVE-2019-9686

CVE-2019-9686 affects pacman before 5.1.3. The issue arises when installing a remote package via a URL (pacman -U ): the unsanitized Content-Disposition filename can contain slashes and is used in rename(), enabling a remote attacker to place the file anywhere in the filesystem and potentially ac...

CVE-2016-5434

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

Out-of-bounds

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

CVE-2016-5434

libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service infinite loop or out-of-bounds read via a crafted signature file...

CVE-2016-5434

The CVE-2016-5434 issue affects libalpm, as used by pacman 5.0.1. It allows a crafted signature file to trigger a denial of service via an infinite loop or out-of-bounds read. Root cause: improper handling in signature processing within libalpm. Impact: denial of service with potential unavailabi...