CVE-2019-18183: OS Command Injection
pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the applydeltas() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted database and delta file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18183?
CVE-2019-18183 has a high severity due to its potential for arbitrary command injection.
How do I fix CVE-2019-18183?
To fix CVE-2019-18183, update Pacman to version 5.2 or later.
Who is affected by CVE-2019-18183?
CVE-2019-18183 affects users of Pacman versions prior to 5.2 and specific versions of Fedora.
What conditions are required for exploiting CVE-2019-18183?
Exploitation of CVE-2019-18183 requires the use of unsigned databases and enabling the non-default delta feature.
Is CVE-2019-18183 a local or remote vulnerability?
CVE-2019-18183 is considered a local vulnerability as it requires direct access to the vulnerable application.