Vendors / Pacman Project Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 1
Exploited now Pacman Project records in CISA KEV No Pacman Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 48
pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03672 · Published 2020-02-24 · No fix listed CWE-78
Priority MEDIUM 48
pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03672 · Published 2020-02-24 · No fix listed CWE-78
Priority MEDIUM 44
pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received from a Content-Disposition header.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.0338 · Published 2019-03-11 · No fix listed CWE-22
Priority LOW 28
libalpm, as used in pacman 5.0.1, allows remote attackers to cause a denial of service (infinite loop or out-of-bounds read) via a crafted signature file.
CVSS 3.0 MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.01476 · Published 2017-01-30 · No fix listed CWE-125
Open these records in search → All records by CVSS severity
2 1 1 0 0
THREATIST.IORead the docs