N/A - MDVSA-2015:207

Executive Summary

Informations
Name	MDVSA-2015:207	First vendor Publication	2015-04-27
Vendor	Mandriva	Last vendor Modification	2015-04-27
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	Not Defined	Attack Range	Not Defined
Cvss Impact Score	Not Defined	Attack Complexity	Not Defined
Cvss Expoit Score	Not Defined	Authentication	Not Defined
Calculate full CVSS 2.0 Vectors scores

Detail

Updated perl-Module-Signature package fixes the following security vulnerabilities reported by John Lightsey:

Module::Signature could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.

When verifying the contents of a CPAN module, Module::Signature ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during make test

When generating checksums from the signed manifest, Module::Signature used two argument open() calls to read the files. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process.

Several modules were loaded at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in \@INC.