Your message dated Wed, 02 Sep 2026 21:17:07 +0000
with message-id <[email protected]>
and subject line Bug#1138051: fixed in libio-compress-perl 2.213-1+deb13u1
has caused the Debian Bug report #1138051,
regarding libio-compress-perl: CVE-2026-48959
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138051: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138051
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libio-compress-perl
Version: 2.219-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libio-compress-perl.
CVE-2026-48959[0]:
| IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU
| exhaustion via per-byte read loop in fastForward. fastForward()
| compares length $offset (the digit count of the offset, 1 to 19)
| against the chunk size $c instead of $offset itself, so $c shrinks
| from 16 KiB to 1-19 bytes per iteration. Extracting a named entry
| from an attacker supplied zip via IO::Uncompress::Unzip->new($zip,
| Name => $target) drives a per-byte read loop scaling with the
| entry's compressed size, up to the non-Zip64 4 GiB cap.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48959
https://www.cve.org/CVERecord?id=CVE-2026-48959
[1] https://lists.security.metacpan.org/cve-announce/msg/40434381/
[2]
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libio-compress-perl
Source-Version: 2.213-1+deb13u1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libio-compress-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libio-compress-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 17:20:53 +0200
Source: libio-compress-perl
Architecture: source
Version: 2.213-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1138051 1138052 1138055 1146065
Changes:
libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium
.
* [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
(Closes: #1146065)
* [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
(Closes: #1138051)
* [Security] CVE-2026-48961: crash in zipdetails.
(Closes: #1138052)
* [Security] CVE-2026-48962: code execution in IO-Compress via output
globs.
(Closes: #1138055)
* Add debian/source/include-binaries for CVE-2025-15649 test case.
Checksums-Sha1:
fc4bc97cc4cfd6cd3659a460056ac7f316426c85 2648
libio-compress-perl_2.213-1+deb13u1.dsc
5e98b25e3c48216dae342d1751b78515f6f0dd59 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Checksums-Sha256:
b761c9afa8138679201bcf9d55b7d82f09672a069fefd4d8e930514743373974 2648
libio-compress-perl_2.213-1+deb13u1.dsc
01d4a6d5f838133cde95d05687353654e890df00aea22ac72e29872e48dbbba9 10444
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Files:
c01f924f28bcf2199aaaeeb7eadf82da 2648 perl optional
libio-compress-perl_2.213-1+deb13u1.dsc
ce5e74536028a6f2938b9eace5e16123 10444 perl optional
libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSWxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZqLA/+O1vZOnjgeNOMGrAcsMLXrHjF4Sz7jxcaa2XA6q9Ts8CpjFNP2wmZOu4K
uvTGGzEI6KYV7r1VzEDA9m9WeYwUz9kiK2RTyl4AB0MIWqpWivUvpaPiNVuQajkG
Fc9my5O6W89N7lXoFjS/1VTJRpolrTKcHUj5WAKYw61HFI0VgrDOVmP2uH7wUWYP
n9TKSM/7W/s0I3D0ABVoFjoRzc/gWvH5F6ylAA8o4z5+S4OzcEvKFXxyO4XCVY/P
heygV36XtGLXCpi6hzXACsjvdT2OHurXBAmOg9LsC2vtKIEOpIW6NifgzKcQPpz1
cEsAKBQHwe4H9VhpYopPK+DS39pdsmEto5C/KfBA7WJnHsRwwawapWDYv3Qi0WhZ
4YntHUIbbH9O9nSBImeO5ooKegn/f/OIb0KCR3DYVo5cUjnB8nmdl81lIUZJZ7o0
ja5uBpaI01FNz0y6XzsOwfACoU0I6m4jbXGh9tspc38L7lIaWzwfq1ELxSJztsvT
JGX+Vd/tpCmt7hvqQi8Tu2M2Jy5b1KU9+xZJVEdni3oMb2udvLqOOslMh5d6HxOI
TcMKKim1LUK4oeZ7YOr/l4S05iQBR/+4n6JsyCD/jCpHgYuLI1zqgO9QXeI4hXiV
yi4gjUGuDA2H6KToBqqF1i4MsInXrZqLigmw7oe/DPMrGVoiRr0=
=lcdZ
-----END PGP SIGNATURE-----
pgpy1TyZbYCZC.pgp
Description: PGP signature
--- End Message ---
