CVE-2015-3409: Untrusted search path vulnerability in Module::Signature before 0.75 allows local users to gain privileges...

Security readout for executives and security teams

Older versions of Perl Module::Signature can load a malicious module from the current working directory. A local user could abuse that behavior to run code with the privileges of a process using Module::Signature, especially if it is run from an untrusted directory. Exposure is likely limited to systems with Module::Signature before 0.75 installed, including environments covered by Debian DSA-3261 or Ubuntu USN-2607-1. Risk depends on whether local users can influence the working directory or files visible to privileged Module::Signature executions. Prioritize remediation on shared servers, build systems, and administrative hosts where local users or automation can influence working directories. Lower urgency is reasonable for isolated systems with no untrusted local access, but patching is still appropriate because vendor fixes exist. Mitigation focus: Upgrade Module::Signature to version 0.75 or later.; Apply relevant Debian or Ubuntu security updates where packaged.; Avoid privileged Module::Signature use from untrusted writable directories until patched..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.