Your message dated Wed, 02 Sep 2026 21:17:07 +0000
with message-id <[email protected]>
and subject line Bug#1146065: fixed in libio-compress-perl 2.213-1+deb13u1
has caused the Debian Bug report #1146065,
regarding IO-Compress: CVE-2025-15649
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146065: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146065
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: perl
Version: 5.40.1-6
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], [email protected]
Forwarded:
https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8
Control: found -1 5.32.1-4
Control: found -1 5.36.0-1
Control: found -1 5.42.2-1
The following vulnerability was published[0] for IO-Compress:
CVE ID: CVE-2025-15649
Distribution: IO-Compress
Versions: before 2.215
MetaCPAN: https://metacpan.org/dist/IO-Compress
VCS Repo: https://github.com/pmqs/IO-Compress
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught
exception when parsing zip header with malformed DOS date
Description
-----------
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught
exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes the local-file-header last-modification date
field and calls Time::Local::timelocal() without an eval guard. A
header whose date field decodes to an out-of-range month, day, or hour
causes timelocal() to die.
The exception propagates out of IO::Uncompress::Unzip->new($file) where
callers expect undef plus $UnzipError.
This CPAN module is shipped in both libio-compress-perl and perl. The
libio-compress-perl package was already fixed for sid + forky in version
2.215-1.
Copying the libio-compress-perl maintainers, and Salvatore for his security
hat. Not sure if we want to track this separately for the libio-compress-perl
package at this point. Feel free to clone this bug if it helps.
[0] https://lists.security.metacpan.org/cve-announce/msg/40434380/
--
Niko Tyni [email protected]
--- End Message ---
--- Begin Message ---
Source: libio-compress-perl
Source-Version: 2.213-1+deb13u1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libio-compress-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libio-compress-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 17:20:53 +0200
Source: libio-compress-perl
Architecture: source
Version: 2.213-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1138051 1138052 1138055 1146065
Changes:
libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium
.
* [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
(Closes: #1146065)
* [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
(Closes: #1138051)
* [Security] CVE-2026-48961: crash in zipdetails.
(Closes: #1138052)
* [Security] CVE-2026-48962: code execution in IO-Compress via output
globs.
(Closes: #1138055)
* Add debian/source/include-binaries for CVE-2025-15649 test case.
Checksums-Sha1:
fc4bc97cc4cfd6cd3659a460056ac7f316426c85 2648
libio-compress-perl_2.213-1+deb13u1.dsc
5e98b25e3c48216dae342d1751b78515f6f0dd59 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Checksums-Sha256:
b761c9afa8138679201bcf9d55b7d82f09672a069fefd4d8e930514743373974 2648
libio-compress-perl_2.213-1+deb13u1.dsc
01d4a6d5f838133cde95d05687353654e890df00aea22ac72e29872e48dbbba9 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Files:
c01f924f28bcf2199aaaeeb7eadf82da 2648 perl optional
libio-compress-perl_2.213-1+deb13u1.dsc
ce5e74536028a6f2938b9eace5e16123 10444 perl optional
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSWxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZqLA/+O1vZOnjgeNOMGrAcsMLXrHjF4Sz7jxcaa2XA6q9Ts8CpjFNP2wmZOu4K
uvTGGzEI6KYV7r1VzEDA9m9WeYwUz9kiK2RTyl4AB0MIWqpWivUvpaPiNVuQajkG
Fc9my5O6W89N7lXoFjS/1VTJRpolrTKcHUj5WAKYw61HFI0VgrDOVmP2uH7wUWYP
n9TKSM/7W/s0I3D0ABVoFjoRzc/gWvH5F6ylAA8o4z5+S4OzcEvKFXxyO4XCVY/P
heygV36XtGLXCpi6hzXACsjvdT2OHurXBAmOg9LsC2vtKIEOpIW6NifgzKcQPpz1
cEsAKBQHwe4H9VhpYopPK+DS39pdsmEto5C/KfBA7WJnHsRwwawapWDYv3Qi0WhZ
4YntHUIbbH9O9nSBImeO5ooKegn/f/OIb0KCR3DYVo5cUjnB8nmdl81lIUZJZ7o0
ja5uBpaI01FNz0y6XzsOwfACoU0I6m4jbXGh9tspc38L7lIaWzwfq1ELxSJztsvT
JGX+Vd/tpCmt7hvqQi8Tu2M2Jy5b1KU9+xZJVEdni3oMb2udvLqOOslMh5d6HxOI
TcMKKim1LUK4oeZ7YOr/l4S05iQBR/+4n6JsyCD/jCpHgYuLI1zqgO9QXeI4hXiV
yi4gjUGuDA2H6KToBqqF1i4MsInXrZqLigmw7oe/DPMrGVoiRr0=
=lcdZ
-----END PGP SIGNATURE-----
pgpNAEfa0aFJF.pgp
Description: PGP signature
--- End Message ---
