CVE-2019-18182

The CVE-2019-18182 entry concerns pacman before 5.2. The vulnerability is a command-injection in download_with_xfercommand() in conf.c, exploitable when unsigned databases are used and a non-default XferCommand is enabled, with attacker-controlled database data. Impact is arbitrary command execut...

CVE-2019-18183

CVE-2019-18183 affects pacman and its libalpm/sync.c apply_deltas() in the delta processing path. The vulnerability exists when unsigned databases are used and the non-default delta feature is enabled, allowing an attacker-controlled crafted database and delta file to inject arbitrary commands. T...

CVE-2019-9686

CVE-2019-9686 affects pacman before 5.1.3. The issue arises when installing a remote package via a URL (pacman -U ): the unsanitized Content-Disposition filename can contain slashes and is used in rename(), enabling a remote attacker to place the file anywhere in the filesystem and potentially ac...

CVE-2016-5434

The CVE-2016-5434 issue affects libalpm, as used by pacman 5.0.1. It allows a crafted signature file to trigger a denial of service via an infinite loop or out-of-bounds read. Root cause: improper handling in signature processing within libalpm. Impact: denial of service with potential unavailabi...