CVE-2016-9094

Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs can be exported for review by the user in a variety of formats including .CSV files. Prior to 14.0 MP1 and 12.1 RU6 MP7, the potential exists for file...

CVE-2016-9094

Symantec Endpoint Protection (SEP) Client 12.1.x before 12.1 RU6 MP7 or 14.0.x before 14.0 MP1 is affected by CVE-2016-9094. The issue arises when exporting quarantine logs (CSV format); file metadata can be interpreted as a formula, enabling a formula-injection style vulnerability. Exploitation ...