CVE-2015-3406
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the...
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
CVE-2015-3406- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-681
- Updated
- 2026-11-02
CVE List No score
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
CVE-2015-3406- Updated
- 2026-11-02
EUVDEUVD-2015-3450 No score
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
EUVD-2015-3450- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2jr6-2g4g-4jhj No score
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the...
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
GHSA-2jr6-2g4g-4jhj- Updated
- 2026-11-02
OSV
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
CVE-2015-3406- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3406
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
DEBIAN-CVE-2015-3406- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3406
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
- Record
UBUNTU-CVE-2015-3406- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10458-1 No score
perl-Module-Signature-0.81-1.1 on GA media
These are all security issues fixed in the perl-Module-Signature-0.81-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10458-1- Updated
- 2026-11-02
OSVUSN-2607-1 No score
libmodule-signature-perl vulnerabilities
John Lightsey discovered that Module::Signature incorrectly handled PGP signature boundaries. A remote attacker could use this issue to trick Module::Signature into parsing the unsigned portion of the SIGNATURE file as the signed portion. (CVE-2015-3406)
John Lightsey discovered that Module::Signature incorrectly handled files that were not listed in the SIGNATURE file. A remote attacker could use this flaw to execute arbitrary code when tests were run. (CVE-2015-3407)
John Lightsey discovered that Module::Signature incorrectly handled embedded shell commands in the SIGNATURE file. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3408)
John Lightsey discovered that Module::Signature incorrectly handled module loading. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3409)
- Record
USN-2607-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmodule-signature-perlDebian:12 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:13 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:14 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:6.0 From an advisory covering 4 CVEs |
before 0.63-1+squeeze2, plus listed versions 0.63-10.63-1+squeeze1 |
0.63-1+squeeze2 |
libmodule-signature-perlDebian:7 From an advisory covering 4 CVEs |
before 0.68-1+deb7u2, plus listed versions 0.68-10.68-1+deb7u1 |
0.68-1+deb7u2 |
libmodule-signature-perlDebian:8 From an advisory covering 4 CVEs |
before 0.73-1+deb8u1, plus listed versions 0.73-1 |
0.73-1+deb8u1 |
libmodule-signature-perlUbuntu:14.04:LTS |
before 0.73-1ubuntu0.14.04.1, plus listed versions 0.73-1 |
0.73-1ubuntu0.14.04.1 |
libmodule-signature-perlUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 0.73-1ubuntu0.14.04.1, plus listed versions 0.73-1 |
0.73-1ubuntu0.14.04.1 |
perl-Module-SignatureopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 0.81-1.1 | 0.81-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3406 is a high vulnerability (CVSS 7.5) in Canonical Ubuntu Linux, published April 23, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.29%, the 83rd percentile. Fixed in libmodule-signature-perl 0.78-1.
References
openwall.com/lists/oss-security/2015/04/07/1
github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
metacpan.org/changes/distribution/Module-Signature
ubuntu.com/usn/usn-2607-1
nvd.nist.gov/vuln/detail/CVE-2015-3406
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2015-3406
cve.org/CVERecord?id=CVE-2015-3406
suse.com/security/cve/CVE-2013-2145