CVE-2019-18183: 
NixOS vulnerability analysis and mitigation

Pacman before version 5.2 contains a vulnerability (CVE-2019-18183) that allows arbitrary command injection in the apply_deltas() function located in lib/libalpm/sync.c. This vulnerability was discovered in October 2019 and affects the package manager used by the Arch Linux distribution (CVE Details).

The vulnerability exists in the apply_deltas() function within lib/libalpm/sync.c of the Pacman package manager. The issue can be exploited when unsigned databases are used. For successful exploitation, the user must enable the non-default delta feature and retrieve an attacker-controlled crafted database and delta file (Debian Security).

If successfully exploited, this vulnerability allows attackers to execute arbitrary commands through specially crafted database and delta files. The impact is particularly severe as Pacman is the primary package management tool for Arch Linux systems (Fedora Update).

The vulnerability was fixed in Pacman version 5.2.0. Users are strongly advised to upgrade to this version or later. The fix was also backported to various Linux distributions, including Fedora, which released security updates to address this vulnerability (Fedora Update).