[<prev] [next>] [day] [month] [year] [list]
Message-Id: <528D729E-AF97-4D42-AB5B-330B47BAF258@stig.io>
Date: Wed, 27 May 2026 04:27:33 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2025-15649: IO::Uncompress::Unzip versions before 2.215 for Perl
propagate uncaught exception when parsing zip header with malformed DOS date
========================================================================
CVE-2025-15649 CPAN Security Group
========================================================================
CVE ID: CVE-2025-15649
Distribution: IO-Compress
Versions: before 2.215
MetaCPAN: https://metacpan.org/dist/IO-Compress
VCS Repo: https://github.com/pmqs/IO-Compress
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught
exception when parsing zip header with malformed DOS date
Description
-----------
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught
exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes the local-file-header last-modification date
field and calls Time::Local::timelocal() without an eval guard. A
header whose date field decodes to an out-of-range month, day, or hour
causes timelocal() to die.
The exception propagates out of IO::Uncompress::Unzip->new($file) where
callers expect undef plus $UnzipError.
Problem types
-------------
- CWE-248 Uncaught Exception
Solutions
---------
Upgrade to IO-Compress 2.215 or later.
References
----------
https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch
https://github.com/pmqs/IO-Compress/issues/65
https://metacpan.org/release/PMQS/IO-Compress-2.215/changes
Timeline
--------
- 2025-10-25: Issue reported.
- 2026-01-30: Version 2.215 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
