cve/2015/CVE-2015-8607.md

CVE-2015-8607

Description

The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

POC

Reference

• http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
• https://www.oracle.com/security-alerts/cpujul2020.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/HotDB-Community/HotDB-Engine