Register | Log in

libio-compress-perl

bundle of IO::Compress modules

Choose email to subscribe with

general

source: libio-compress-perl (main)
version: 2.225-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: Damyan Ivanov (DMD) – gregor herrmann (DMD) – Xavier Guimard (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.101-1
oldstable: 2.204-1
old-sec: 2.204-1+deb12u1
stable: 2.213-1
testing: 2.225-1
unstable: 2.225-1

versioned links

2.101-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.204-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.204-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.213-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.225-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libio-compress-perl

action needed

3 security issues in bullseye high

There are 3 open security issues in bullseye.

3 important issues:

CVE-2025-15649: IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
CVE-2026-48959: IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
CVE-2026-48962: IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.

Created: 2026-05-27 Last update: 2026-08-31 22:18

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.225-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit f06a5e8f95c2b6b66157848ede08cc8d1c09640e
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 00:29:09 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 930ed5d9a3ec9a2c7dcd838c1e4c4cdad80e9479
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 00:29:09 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-08 01:03

news

[2026-10-21] libio-compress-perl 2.225-1 MIGRATED to testing (Debian testing watch)
[2026-10-17] Accepted libio-compress-perl 2.225-1 (source) into unstable (gregor herrmann)
[2026-10-11] libio-compress-perl 2.224-1 MIGRATED to testing (Debian testing watch)
[2026-10-06] Accepted libio-compress-perl 2.224-1 (source) into unstable (gregor herrmann)
[2026-10-02] Accepted libio-compress-perl 2.204-1+deb12u1 (source) into oldstable-security (Arnaud Rebillout)
[2026-09-02] Accepted libio-compress-perl 2.213-1+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: gregor herrmann)
[2026-07-07] libio-compress-perl 2.223-1 MIGRATED to testing (Debian testing watch)
[2026-07-04] Accepted libio-compress-perl 2.223-1 (source) into unstable (gregor herrmann)
[2026-07-03] Accepted libio-compress-perl 2.222-1 (source) into unstable (gregor herrmann)
[2026-06-25] libio-compress-perl 2.221-1 MIGRATED to testing (Debian testing watch)
[2026-06-22] Accepted libio-compress-perl 2.221-1 (source) into unstable (gregor herrmann)
[2026-05-30] libio-compress-perl 2.220-1 MIGRATED to testing (Debian testing watch)
[2026-05-27] Accepted libio-compress-perl 2.220-1 (source) into unstable (gregor herrmann)
[2026-03-15] libio-compress-perl 2.219-2 MIGRATED to testing (Debian testing watch)
[2026-03-12] Accepted libio-compress-perl 2.219-2 (source) into unstable (gregor herrmann)
[2026-03-11] Accepted libio-compress-perl 2.219-1 (source) into unstable (gregor herrmann)
[2026-02-20] libio-compress-perl 2.217-1 MIGRATED to testing (Debian testing watch)
[2026-02-06] Accepted libio-compress-perl 2.217-1 (source) into unstable (gregor herrmann)
[2025-10-30] libio-compress-perl 2.214-1 MIGRATED to testing (Debian testing watch)
[2025-10-27] Accepted libio-compress-perl 2.214-1 (source) into unstable (gregor herrmann)
[2024-09-04] libio-compress-perl 2.213-1 MIGRATED to testing (Debian testing watch)
[2024-09-01] Accepted libio-compress-perl 2.213-1 (source) into unstable (gregor herrmann)
[2024-05-03] libio-compress-perl 2.212-1 MIGRATED to testing (Debian testing watch)
[2024-04-28] Accepted libio-compress-perl 2.212-1 (source) into unstable (gregor herrmann)
[2024-04-07] Accepted libio-compress-perl 2.211-1 (source) into unstable (gregor herrmann)
[2024-04-06] libio-compress-perl 2.208-1 MIGRATED to testing (Debian testing watch)
[2024-04-03] Accepted libio-compress-perl 2.208-1 (source) into unstable (gregor herrmann)
[2024-02-25] libio-compress-perl 2.207-1 MIGRATED to testing (Debian testing watch)
[2024-02-22] Accepted libio-compress-perl 2.207-1 (source) into unstable (gregor herrmann)
[2023-08-01] libio-compress-perl 2.206-1 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.225-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing