Don’t panic! “Unpatchable” Mac vulnerability discovered

Researchers at MITs Computer Science & Artificial Intelligence Lab CSAIL found an attack surface in a hardware-level security mechanism utilized in Apple M1 chips. The flaw is unpatchable, but attackers would need to chain it with other vulnerabilities to make use of the attack method. The hardwa...

MIT Researchers Discover New Flaw in Apple M1 CPUs That Can't Be Patched

A novel hardware attack dubbed PACMAN has been demonstrated against Apple's M1 processor chipsets, potentially arming a malicious actor with the capability to gain arbitrary code execution on macOS systems. It leverages "speculative execution attacks to bypass an important memory protection...

[ASA-202205-4] firefox: multiple issues

Arch Linux Security Advisory ASA-202205-4 ========================================= Severity: High Date : 2022-05-16 CVE-ID : CVE-2022-29909 CVE-2022-29911 CVE-2022-29912 CVE-2022-29914 CVE-2022-29915 CVE-2022-29916 CVE-2022-29917 CVE-2022-29918 Package : firefox Type : multiple issues Remote : Y...

Fedora: Security Advisory for pacman (FEDORA-2020-419a75aef6)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 32 Update: pacman-5.2.1-2.fc32

Pacman is the package manager used by the Arch distribution. It can be used to install Arch into a container or to recover an Arch installation from a Fedora system see arch-install-scripts package for instructions. Pacman is a frontend for the ALPM Arch Linux Package Management library Pacman do...

Fedora: Security Advisory for pacman (FEDORA-2020-781d0b2efe)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for pacman (FEDORA-2020-096fbcc91f)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 30 : pacman (2020-096fbcc91f)

Update to latest version. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 31 : pacman (2020-781d0b2efe)

Update to latest version. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

[SECURITY] Fedora 31 Update: pacman-5.2.1-2.fc31

Pacman is the package manager used by the Arch distribution. It can be used to install Arch into a container or to recover an Arch installation from a Fedora system see arch-install-scripts package for instructions. Pacman is a frontend for the ALPM Arch Linux Package Management library Pacman do...

[SECURITY] Fedora 30 Update: pacman-5.2.1-2.fc30

Pacman is the package manager used by the Arch distribution. It can be used to install Arch into a container or to recover an Arch installation from a Fedora system see arch-install-scripts package for instructions. Pacman is a frontend for the ALPM Arch Linux Package Management library Pacman do...

pacman command injection vulnerability (CNVD-2020-14329)

pacman is a package manager used in Linux. A command injection vulnerability exists in the 'downloadwithxfercommand' function in the conf.c file in pacman versions prior to 5.2. The vulnerability stems from a networked system or product not properly filtering specific elements of external input...

pacman command injection vulnerability

pacman is a package manager used in Linux. A command injection vulnerability exists in the 'applydeltas' function in the lib/libalpm/sync.c file in pacman versions prior to 5.2. The vulnerability stems from a network system or product not properly filtering special elements of external input data...

CVE-2019-18182

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted databa...

CVE-2019-18182

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted databa...

CVE-2019-18183

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

CVE-2019-18183

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted...

Command injection

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted databa...

CVE-2019-18182

The CVE-2019-18182 entry concerns pacman before 5.2. The vulnerability is a command-injection in download_with_xfercommand() in conf.c, exploitable when unsigned databases are used and a non-default XferCommand is enabled, with attacker-controlled database data. Impact is arbitrary command execut...

CVE-2019-18182

pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the downloadwithxfercommand function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted databa...