CVE-2015-3407
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files...
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
Exploit likelihood
What each source reports
NVD Score used
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
CVE-2015-3407- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
CVE-2015-3407- Updated
- 2026-11-02
EUVDEUVD-2015-3451 No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
EUVD-2015-3451- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2qpg-g63h-ghqr No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files...
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
GHSA-2qpg-g63h-ghqr- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
CVE-2015-3407- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-3407 No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
DEBIAN-CVE-2015-3407- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10458-1 No score
perl-Module-Signature-0.81-1.1 on GA media
These are all security issues fixed in the perl-Module-Signature-0.81-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10458-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3407 No score
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
- Record
UBUNTU-CVE-2015-3407- Updated
- 2026-11-02
OSVUSN-2607-1 No score
libmodule-signature-perl vulnerabilities
John Lightsey discovered that Module::Signature incorrectly handled PGP signature boundaries. A remote attacker could use this issue to trick Module::Signature into parsing the unsigned portion of the SIGNATURE file as the signed portion. (CVE-2015-3406)
John Lightsey discovered that Module::Signature incorrectly handled files that were not listed in the SIGNATURE file. A remote attacker could use this flaw to execute arbitrary code when tests were run. (CVE-2015-3407)
John Lightsey discovered that Module::Signature incorrectly handled embedded shell commands in the SIGNATURE file. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3408)
John Lightsey discovered that Module::Signature incorrectly handled module loading. A remote attacker could use this issue to execute arbitrary code during signature verification. (CVE-2015-3409)
- Record
USN-2607-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmodule-signature-perlDebian:12 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:13 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:14 |
before 0.78-1 | 0.78-1 |
libmodule-signature-perlDebian:6.0 From an advisory covering 4 CVEs |
before 0.63-1+squeeze2, plus listed versions 0.63-10.63-1+squeeze1 |
0.63-1+squeeze2 |
libmodule-signature-perlDebian:7 From an advisory covering 4 CVEs |
before 0.68-1+deb7u2, plus listed versions 0.68-10.68-1+deb7u1 |
0.68-1+deb7u2 |
libmodule-signature-perlDebian:8 From an advisory covering 4 CVEs |
before 0.73-1+deb8u1, plus listed versions 0.73-1 |
0.73-1+deb8u1 |
libmodule-signature-perlUbuntu:14.04:LTS |
before 0.73-1ubuntu0.14.04.1, plus listed versions 0.73-1 |
0.73-1ubuntu0.14.04.1 |
libmodule-signature-perlUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 0.73-1ubuntu0.14.04.1, plus listed versions 0.73-1 |
0.73-1ubuntu0.14.04.1 |
perl-Module-SignatureopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 0.81-1.1 | 0.81-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3407 is a medium vulnerability (CVSS 5.0) in Canonical Ubuntu Linux, published April 23, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. Fixed in libmodule-signature-perl 0.78-1.
References
metacpan.org/changes/distribution/Module-Signature
debian.org/security/2015/dsa-3261
openwall.com/lists/oss-security/2015/04/07/1
github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
ubuntu.com/usn/usn-2607-1
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-3407
security-tracker.debian.org/tracker/CVE-2015-3407
cve.org/CVERecord?id=CVE-2015-3407
suse.com/security/cve/CVE-2013-2145