Published: 19/05/2015 Updated: 04/11/2017

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Module::Signature prior to 0.74 allows remote malicious users to bypass signature verification for files via a signature file that does not list the files.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 14.10
canonical ubuntu linux 15.04
module-signature project module-signature

Debian Bug report logs - #783451 libmodule-signature-perl: CVE-2015-3406 CVE-2015-3407 CVE-2015-3408 CVE-2015-3409 Package: src:libmodule-signature-perl; Maintainer for src:libmodule-signature-perl is Debian Perl Group <pkg-perl-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> ...

Several security issues were fixed in Module::Signature ...

Multiple vulnerabilities were discovered in libmodule-signature-perl, a Perl module to manipulate CPAN SIGNATURE files The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-3406 John Lightsey discovered that Module::Signature could parse the unsigned portion of the SIGNATURE file as the signed portio ...

Module::Signature before 074 allows remote attackers to bypass signature verification for files via a signature file that does not list the files ...

CWE-284 https://metacpan.org/changes/distribution/Module-Signature http://ubuntu.com/usn/usn-2607-1 http://www.openwall.com/lists/oss-security/2015/04/23/17 http://www.openwall.com/lists/oss-security/2015/04/07/1 https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f http://www.debian.org/security/2015/dsa-3261 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783451 https://usn.ubuntu.com/2607-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-3407

CVE-2015-3407

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect