NVD Vulnerability Detail

CVE-2015-3406

Summary	The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
Publication Date	Nov. 30, 2019, 6:15 a.m.
Registration Date	Jan. 26, 2021, 2:49 p.m.
Last Update	Nov. 21, 2024, 11:29 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:module-signature_project:module-signature::::::::					0.74

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*

Related information, measures and tools

No	URL	タグ
1	http://ubuntu.com/usn/usn-2607-1	Patch Release Notes Third Party Advisory
2	http://ubuntu.com/usn/usn-2607-1	Patch Release Notes Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2015/04/07/1	Mailing List Patch Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2015/04/07/1	Mailing List Patch Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2015/04/23/17	Mailing List Patch Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2015/04/23/17	Mailing List Patch Third Party Advisory
7	https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f	Patch Third Party Advisory
8	https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f	Patch Third Party Advisory
9	https://metacpan.org/changes/distribution/Module-Signature	Release Notes Vendor Advisory
10	https://metacpan.org/changes/distribution/Module-Signature	Release Notes Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-681	数値型間の変換の誤り	https://cwe.mitre.org/data/definitions/681.html

JVN Vulnerability Information

Module::Signature における数値型間の変換の誤りに関する脆弱性

Title	Module::Signature における数値型間の変換の誤りに関する脆弱性
Summary	Module::Signature には、数値型間の変換の誤りに関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 7, 2015, midnight
Registration Date	Dec. 19, 2019, 4:39 p.m.
Last Update	Dec. 19, 2019, 4:39 p.m.

Affected System

Canonical

Ubuntu

audreyt

Module::Signature 0.74 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-3406	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3406
National Vulnerability Database (NVD)
2	CVE-2015-3406	https://nvd.nist.gov/vuln/detail/CVE-2015-3406

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-681	http://cwe.mitre.org/data/definitions/681.html

ベンダー情報

No	Name	URL
CPAN
1	[Changes for 0.74 - Tue Apr 7 02:39:14 CST 2015]	https://metacpan.org/changes/distribution/Module-Signature
GitHub
2	* Fix issues reported by John Lightsey	https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Ubuntu Security Notice
3	USN-2607-1	https://usn.ubuntu.com/2607-1/

その他

No	Name	URL
関連文書
1	CVE request: Module::Signature before 0.75 - multiple vulnerabilities	http://www.openwall.com/lists/oss-security/2015/04/07/1
2	Re: CVE request: Module::Signature before 0.75 - multiple vulnerabilities	http://www.openwall.com/lists/oss-security/2015/04/23/17

Change Log

No	Changed Details	Date of change
1	[2019年12月19日] 掲載	Dec. 19, 2019, 4:39 p.m.