CVEs-PoC/2016/CVE-2016-1244.md

CVE-2016-1244

Description

The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf file.

POC

Reference

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838248

Github

• https://github.com/NaInSec/CVE-LIST
• https://github.com/lclevy/ADFlib