CVEvulnerability
CVE-2018-15912
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-08-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.8 HIGH — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-269
Description
An issue was discovered in manjaro-update-system.sh in manjaro-system 20180716-1 on Manjaro Linux. A local attacker can install or remove arbitrary packages and package repositories potentially containing hooks with arbitrary code, which will automatically be run as root, or remove packages vital to the system.
Affected configurations
• manjaro manjaro linux (<= 20180716-1)
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://gitlab.manjaro.org/packages/core/manjaro-system/commit/8208b8a Patch, Third Party Advisory
- https://lists.manjaro.org/pipermail/manjaro-security/2018-August/000785.html Exploit, Mailing List, Vendor Advisory
- https://gitlab.manjaro.org/packages/core/manjaro-system/commit/8208b8a Patch, Third Party Advisory
- https://lists.manjaro.org/pipermail/manjaro-security/2018-August/000785.html Exploit, Mailing List, Vendor Advisory