pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the
    download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit
    the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled
    crafted database and package. (CVE-2019-18182)

  - pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas()
    function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user
    must enable the non-default delta feature and retrieve an attacker-controlled crafted database and delta
    file. (CVE-2019-18183)

Update to latest version.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
406203	Alpine: multiple pacman packages: security update to 5.2.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406203	Alpine: multiple pacman packages: security update to 5.2.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
135371	Fedora 31 : pacman (2020-781d0b2efe)	Nessus	Fedora Local Security Checks	critical
135368	Fedora 30 : pacman (2020-096fbcc91f)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2019-18182

critical

Tenable Plugins

critical

critical

critical

critical