CVE-2015-3407

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-340810.0Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properlyCVE-2015-34097.2Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges via a Trojan horse module under tCVE-2015-34116.5PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote aCVE-2015-34125.3PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote aCVE-2015-34147.5SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to causeCVE-2015-34157.5The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependeCVE-2015-34167.5The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point coCVE-2015-34176.8Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to causCVE-2015-34187.5The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial oCVE-2015-34196.5vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations CVE-2015-34205.9The ssl-proxy-openssl.c function in Dovecot before 2.2.17, when SSLv3 is disabled, allow remote attackers to cause a denial of service (logiCVE-2015-34216.1The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart"
CVE-2015-3407: Medium severity, CVSS 5.0 | Vulnix