| Package | Affected versions | Patched versions |
|---|---|---|
| pacman | < 5.2 | 5.2 |
pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free