pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.
References
Configurations
History
07 Nov 2023, 03:06
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2020-02-24 15:15
Updated : 2024-02-28 17:28
NVD link : CVE-2019-18182
Mitre link : CVE-2019-18182
CVE.ORG link : CVE-2019-18182
JSON object : View
Products Affected
pacman_project
- pacman
fedoraproject
- fedora
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')