CVE-2015-3408

Description

Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.

How to fix CVE-2015-3408

To remediate CVE-2015-3408, upgrade the affected package to a fixed version below.

• Debian/libmodule-signature-perl—upgrade to 0.78-1 or later

Is CVE-2015-3408 being exploited?

Low — EPSS is 3.9%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.78-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2015-3408