RCE in Typemoon Fate\/hollow Ataraxia

CVE-2015-5672

TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.037 (88.6th percentile) — read the EPSS interpretation.

Affected products

Typemoon Fate\/hollow_ataraxia
Typemoon Fate\/stay_night
Typemoon Fate\/stay_night_\+_hollow_ataraxia_set
Typemoon Witch_on_the_holy_night
N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

vultures@jpcert.or.jp (x_refsource_CONFIRM, Vendor Advisory)
vultures@jpcert.or.jp (x_refsource_JVN, Vendor Advisory, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_JVNDB, Vendor Advisory, third-party-advisory)