CVE Vulnerabilities

CVE-2015-3406

Incorrect Conversion between Numeric Types

Published: Nov 29, 2019 | Modified: Dec 16, 2019
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
6.4 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:P
RedHat/V2
5.1 MODERATE
AV:N/AC:H/Au:N/C:P/I:P/A:P
RedHat/V3
Ubuntu
MEDIUM

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.

Weakness

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Affected Software

Name Vendor Start Version End Version
Module-signature Module-signature_project * 0.74 (excluding)
Libmodule-signature-perl Ubuntu lucid *
Libmodule-signature-perl Ubuntu precise *
Libmodule-signature-perl Ubuntu trusty *
Libmodule-signature-perl Ubuntu upstream *
Libmodule-signature-perl Ubuntu utopic *
Libmodule-signature-perl Ubuntu vivid *

Potential Mitigations

References