Computer Security
[EN] no-pyccku

perl-Module-Signature content spoofing
updated since 05.05.2015
SecurityVulns ID:14444
Threat Level:
Description:Unsigned content can be interpreted as a signed.
Affected:PERL : perl-Module-Signature 0.730
CVE:CVE-2015-3409 (Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.)
 CVE-2015-3408 (Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.)
 CVE-2015-3407 (Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.)
Original documentdocumentUBUNTU, [USN-2607-1] Module::Signature vulnerabilities (12.05.2015)
 documentMANDRIVA, [ MDVSA-2015:207 ] perl-Module-Signature (05.05.2015)

About | Terms of use | Privacy Policy
© SecurityVulns, 3APA3A, Vladimir Dubrovin
Nizhny Novgorod