CVE-2015-3406

Опубликовано: 29 нояб. 2019

Источник: nvd

CVSS3: 7.5

CVSS2: 6.4

EPSS Низкий

Описание

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

Ссылки

http://ubuntu.com/usn/usn-2607-1
Patch
Release Notes
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/07/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/23/17
Mailing List
Patch
Third Party Advisory
https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Patch
Third Party Advisory
https://metacpan.org/changes/distribution/Module-Signature
Release Notes
Vendor Advisory
http://ubuntu.com/usn/usn-2607-1
Patch
Release Notes
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/07/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/23/17
Mailing List
Patch
Third Party Advisory
https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Patch
Third Party Advisory
https://metacpan.org/changes/distribution/Module-Signature
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:module-signature_project:module-signature:*:*:*:*:*:*:*:*

Версия до 0.74 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01266

Низкий

7.5 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-681

Связанные уязвимости

CVE-2015-3406

CVSS3: 7.5

ubuntu

около 6 лет назад

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

CVE-2015-3406

redhat

почти 11 лет назад

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

CVE-2015-3406

CVSS3: 7.5

debian

около 6 лет назад

The PGP signature parsing in Module::Signature before 0.74 allows remo ...

GHSA-2jr6-2g4g-4jhj

github

больше 3 лет назад

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

EPSS

Процентиль: 79%

0.01266

Низкий

7.5 High

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-681