CVE-2019-18183

pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databases are used. To exploit the vulnerability, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted database and delta file.

• CWE-78

• https://git.archlinux.org/pacman.git/commit/?id=c0e9be7973be6c81b22fde91516fb8991e7bb07bPatch, Third Party Advisory
• https://git.archlinux.org/pacman.git/tree/lib/libalpm/sync.c?h=v5.1.3#n767Exploit, Third Party Advisory
• https://github.com/alpinelinux/alpine-secdb/blob/master/v3.11/community.yamlRelease Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TTUXXUW5OCOASIRMJK4RHEPLEA33Y6C/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K53C45EDWBU3UCN3IRIGR5EZUNWXS7BW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KIDJ4XKBZRRVRFFGKUA3ZU6NFIP5JUG3/
• https://git.archlinux.org/pacman.git/commit/?id=c0e9be7973be6c81b22fde91516fb8991e7bb07bPatch, Third Party Advisory
• https://git.archlinux.org/pacman.git/tree/lib/libalpm/sync.c?h=v5.1.3#n767Exploit, Third Party Advisory
• https://github.com/alpinelinux/alpine-secdb/blob/master/v3.11/community.yamlRelease Notes, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TTUXXUW5OCOASIRMJK4RHEPLEA33Y6C/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K53C45EDWBU3UCN3IRIGR5EZUNWXS7BW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KIDJ4XKBZRRVRFFGKUA3ZU6NFIP5JUG3/

Published

Feb 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18178Real Time Engineers FreeRTOS+FAT 160919a has a use after fre…7.5
• CVE-2019-18179An issue was discovered in Open Ticket Request System (OTRS)…4.3
• CVE-2019-1818A vulnerability in the web-based management interface of Cis…6.5
• CVE-2019-18180Improper Check for filenames with overly long extensions in …7.5
• CVE-2019-18181In CloudVision Portal all releases in the 2018.1 and 2018.2 …7.8
• CVE-2019-18182pacman before 5.2 is vulnerable to arbitrary command injecti…9.8
• CVE-2019-18184Crestron DMC-STRO 1.0 devices allow remote command execution…9.8
• CVE-2019-18187Trend Micro OfficeScan versions 11.0 and XG (12.0) could be …7.5
• CVE-2019-18188Trend Micro Apex One could be exploited by an attacker utili…7.5
• CVE-2019-18189A directory traversal vulnerability in Trend Micro Apex One,…9.8
• CVE-2019-1819A vulnerability in the web-based management interface of Cis…6.5
• CVE-2019-18190Trend Micro Security (Consumer) 2020 (v16.x) is affected by …9.8