[Bug 1210614] New: Shell command injection in c2ph tool

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1210614

            Bug ID: 1210614
           Summary: Shell command injection in c2ph tool
           Product: Fedora
           Version: 21
         Component: perl
          Assignee: jplesnik(a)redhat.com
          Reporter: ppisar(a)redhat.com
        QA Contact: extras-qa(a)fedoraproject.org
                CC: cweyl(a)alumni.drew.edu, iarnell(a)gmail.com,
                    jplesnik(a)redhat.com, kasal(a)ucw.cz,
                    perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
                    psabata(a)redhat.com, rc040203(a)freenet.de,
                    tcallawa(a)redhat.com



The c2ph suffers from shell command injection:

$ c2ph -n '; id; x.c'
cc: fatal error: no input files
compilation terminated.
uid=500(petr) gid=500(petr) groups=500(petr),63(audio),100(users),478(mock)
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
sh: x.c: command not found

Tested with perl-5.18.4-308.fc21.x86_64.

Reported to upstream <https://rt.perl.org/Ticket/Display.html?id=124275>;.

-- 
You are receiving this mail because:
You are on the CC list for the bug.