Audrey Tang

6 exploits Active since Aug 2013
CVE-2013-2145 WRITEUP WRITEUP
Canonical Ubuntu Linux < 0.72 - Improper Input Validation
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
CVE-2013-2145 WRITEUP WRITEUP
Canonical Ubuntu Linux < 0.72 - Improper Input Validation
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
CVE-2015-3406 WRITEUP HIGH WRITEUP
Module::Signature <0.74 - Code Injection
The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SIGNATURE file to be treated as the signed portion via unspecified vectors.
CVSS 7.5
CVE-2015-3407 WRITEUP WRITEUP
Module::Signature <0.74 - Auth Bypass
Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.
CVE-2015-3408 WRITEUP WRITEUP
Module::Signature < 0.74 - Remote Code Execution via Crafted SIGNATURE File
Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
CVE-2015-3409 WRITEUP WRITEUP
Module::Signature <0.75 - Privilege Escalation
Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under the current working directory, as demonstrated by a Trojan horse Text::Diff module.