Debian: DSA-3261-2: libmodule-signature-perl regression update

    Date 20 May 2015
    144
    Posted By LinuxSecurity Advisories
    The update for libmodule-signature-perl issued as DSA-3261-1 introduced a regression in the handling of the --skip option of cpansign. Updated packages are now available to address this regression. For reference, the original advisory text follows.
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3261-2                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                      Salvatore Bonaccorso
    May 20, 2015                           https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : libmodule-signature-perl
    Debian Bug     : 785701
    
    The update for libmodule-signature-perl issued as DSA-3261-1 introduced
    a regression in the handling of the --skip option of cpansign. Updated
    packages are now available to address this regression. For reference,
    the original advisory text follows.
    
    Multiple vulnerabilities were discovered in libmodule-signature-perl, a
    Perl module to manipulate CPAN SIGNATURE files. The Common
    Vulnerabilities and Exposures project identifies the following problems:
    
    CVE-2015-3406
    
        John Lightsey discovered that Module::Signature could parses the
        unsigned portion of the SIGNATURE file as the signed portion due to
        incorrect handling of PGP signature boundaries.
    
    CVE-2015-3407
    
        John Lightsey discovered that Module::Signature incorrectly handles
        files that are not listed in the SIGNATURE file. This includes some
        files in the t/ directory that would execute when tests are run.
    
    CVE-2015-3408
    
        John Lightsey discovered that Module::Signature uses two argument
        open() calls to read the files when generating checksums from the
        signed manifest. This allows to embed arbitrary shell commands into
        the SIGNATURE file that would execute during the signature
        verification process.
    
    CVE-2015-3409
    
        John Lightsey discovered that Module::Signature incorrectly handles
        module loading, allowing to load modules from relative paths in
        @INC. A remote attacker providing a malicious module could use this
        issue to execute arbitrary code during signature verification.
    
    For the oldstable distribution (wheezy), this problem has been fixed in
    version 0.68-1+deb7u3.
    
    For the stable distribution (jessie), this problem has been fixed in
    version 0.73-1+deb8u2.
    
    For the unstable distribution (sid), this problem has been fixed in
    version 0.79-1.
    
    We recommend that you upgrade your libmodule-signature-perl packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    LinuxSecurity Poll

    How do you feel about the elimination of the terms 'blacklist' and 'slave' from the Linux kernel?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/32-how-do-you-feel-about-the-elimination-of-the-terms-blacklist-and-slave-from-the-linux-kernel?task=poll.vote&format=json
    32
    radio
    [{"id":"112","title":"I strongly support this change - racially charged language should not be used in the code and documentation of the kernel and other open-source projects.","votes":"3","type":"x","order":"1","pct":42.86,"resources":[]},{"id":"113","title":"I'm indifferent - this small change will not affect broader issues of racial insensitivity and white privilege.","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"114","title":"I'm opposed to this change - there is no need to change language that has been used for years. It doesn't make sense for people to take offense to terminology used in community projects.","votes":"2","type":"x","order":"3","pct":28.57,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.