CVE-2015-3408 Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
HighCVSS 10.0
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libmodule-signature-perl(Debian:12) | < 0.78-1 | 0.78-1 |
| debian/libmodule-signature-perl(Debian:13) | < 0.78-1 | 0.78-1 |
| debian/libmodule-signature-perl(Debian:14) | < 0.78-1 | 0.78-1 |
| module-signature project module-signature | <= 0.73 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
References
- Debian Security Tracker CVE-2015-3408 vendor-advisory
- USN-2607-1 vendor-advisory
- DSA-3261 vendor-advisory
- [oss-security] 20150406 CVE request: Module::Signature before 0.75 - multiple vulnerabilities mailing-list
- [oss-security] 20150423 Re: CVE request: Module::Signature before 0.75 - multiple vulnerabilities mailing-list
- github.com
- metacpan.org
- bugs.debian.org issue-tracking