Your message dated Wed, 02 Sep 2026 21:17:07 +0000
with message-id <[email protected]>
and subject line Bug#1138055: fixed in libio-compress-perl 2.213-1+deb13u1
has caused the Debian Bug report #1138055,
regarding libio-compress-perl: CVE-2026-48962
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138055: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138055
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libio-compress-perl
Version: 2.219-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libio-compress-perl.
CVE-2026-48962[0]:
| IO::Compress versions before 2.220 for Perl can execute arbitrary
| code in File::GlobMapper via an attacker-controlled output glob.
| _parseOutputGlob() wraps the caller-supplied output glob string in
| double quotes and stores it in the parser state; _getFiles() then
| runs the stored expression through eval STRING. A literal double
| quote in the output glob closes the dquote wrapper, and the
| characters that follow are evaluated as Perl. Arbitrary Perl in the
| output glob executes at the calling process's privilege.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48962
https://www.cve.org/CVERecord?id=CVE-2026-48962
[1] https://lists.security.metacpan.org/cve-announce/msg/40434385/
[2]
https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libio-compress-perl
Source-Version: 2.213-1+deb13u1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libio-compress-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libio-compress-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 17:20:53 +0200
Source: libio-compress-perl
Architecture: source
Version: 2.213-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1138051 1138052 1138055 1146065
Changes:
libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium
.
* [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
(Closes: #1146065)
* [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
(Closes: #1138051)
* [Security] CVE-2026-48961: crash in zipdetails.
(Closes: #1138052)
* [Security] CVE-2026-48962: code execution in IO-Compress via output
globs.
(Closes: #1138055)
* Add debian/source/include-binaries for CVE-2025-15649 test case.
Checksums-Sha1:
fc4bc97cc4cfd6cd3659a460056ac7f316426c85 2648
libio-compress-perl_2.213-1+deb13u1.dsc
5e98b25e3c48216dae342d1751b78515f6f0dd59 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Checksums-Sha256:
b761c9afa8138679201bcf9d55b7d82f09672a069fefd4d8e930514743373974 2648
libio-compress-perl_2.213-1+deb13u1.dsc
01d4a6d5f838133cde95d05687353654e890df00aea22ac72e29872e48dbbba9 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Files:
c01f924f28bcf2199aaaeeb7eadf82da 2648 perl optional
libio-compress-perl_2.213-1+deb13u1.dsc
ce5e74536028a6f2938b9eace5e16123 10444 perl optional
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSWxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZqLA/+O1vZOnjgeNOMGrAcsMLXrHjF4Sz7jxcaa2XA6q9Ts8CpjFNP2wmZOu4K
uvTGGzEI6KYV7r1VzEDA9m9WeYwUz9kiK2RTyl4AB0MIWqpWivUvpaPiNVuQajkG
Fc9my5O6W89N7lXoFjS/1VTJRpolrTKcHUj5WAKYw61HFI0VgrDOVmP2uH7wUWYP
n9TKSM/7W/s0I3D0ABVoFjoRzc/gWvH5F6ylAA8o4z5+S4OzcEvKFXxyO4XCVY/P
heygV36XtGLXCpi6hzXACsjvdT2OHurXBAmOg9LsC2vtKIEOpIW6NifgzKcQPpz1
cEsAKBQHwe4H9VhpYopPK+DS39pdsmEto5C/KfBA7WJnHsRwwawapWDYv3Qi0WhZ
4YntHUIbbH9O9nSBImeO5ooKegn/f/OIb0KCR3DYVo5cUjnB8nmdl81lIUZJZ7o0
ja5uBpaI01FNz0y6XzsOwfACoU0I6m4jbXGh9tspc38L7lIaWzwfq1ELxSJztsvT
JGX+Vd/tpCmt7hvqQi8Tu2M2Jy5b1KU9+xZJVEdni3oMb2udvLqOOslMh5d6HxOI
TcMKKim1LUK4oeZ7YOr/l4S05iQBR/+4n6JsyCD/jCpHgYuLI1zqgO9QXeI4hXiV
yi4gjUGuDA2H6KToBqqF1i4MsInXrZqLigmw7oe/DPMrGVoiRr0=
=lcdZ
-----END PGP SIGNATURE-----
pgpDRLjD2jnjM.pgp
Description: PGP signature
--- End Message ---
