Arnaud Rebillout pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8db84ea4 by Arnaud Rebillout at 2026-09-30T09:05:38+07:00
CVE-2026-48961/perl - bookworm is not affected
The issue was introduced in IO::Compress v2.207. In bookworm, we have
Perl 5.36 and it embeds IO::Compress 2.106.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -132214,6 +132214,7 @@ CVE-2026-48961 (IO::Compress versions from 2.207
before 2.220 for Perl ship a zi
[bullseye] - libio-compress-perl <not-affected> (Vulnerable code
introduced later)
- perl 5.40.1-8 (bug #1138855)
[trixie] - perl 5.40.1-6+deb13u1
+ [bookworm] - perl <not-affected> (Vulnerable code introduced later)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/40434383/
NOTE: Introduced with:
https://github.com/pmqs/IO-Compress/commit/ddfe67584a228877e5d28840da75ff32e435a5e3
(v2.207)
NOTE: Fixed by:
https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7
(v2.220)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db84ea45b6ed8d5f61eccc78b86db7933861bba
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db84ea45b6ed8d5f61eccc78b86db7933861bba
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
