CVE-2015-8607: Canonical Ubuntu Linux

High severity, CVSS 7.3. EPSS: 3.1% chance of exploitation in the next 30 days.

The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.

Affected products

• Canonical Ubuntu Linux: version 15.04 only; version 15.10 only
• Debian Debian Linux: version 8.0 only
• Perl Pathtools: up to and including 3.61

Published 2016-01-13. Last modified 2026-06-17.