[<prev] [next>] [day] [month] [year] [list]
Message-Id: <83F769CA-6ABC-4593-BFCF-CE79AAF62A8F@stig.io>
Date: Wed, 27 May 2026 04:51:49 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
oss-security@...ts.openwall.com
Subject: CVE-2026-48961: IO::Compress versions from 2.207 before 2.220 for
Perl ship a zipdetails CLI tool that crashes with undefined subroutine on
Info-ZIP Unix Extra Field with 8-byte UID or GID
========================================================================
CVE-2026-48961 CPAN Security Group
========================================================================
CVE ID: CVE-2026-48961
Distribution: IO-Compress
Versions: from 2.207 before 2.220
MetaCPAN: https://metacpan.org/dist/IO-Compress
VCS Repo: https://github.com/pmqs/IO-Compress
IO::Compress versions from 2.207 before 2.220 for Perl ship a
zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP
Unix Extra Field with 8-byte UID or GID
Description
-----------
IO::Compress versions from 2.207 before 2.220 for Perl ship a
zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP
Unix Extra Field with 8-byte UID or GID.
When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field
(tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to
decode an 8-byte UID or GID value, it dispatches through
decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The
actual function defined in the same file is unpackValue_Q (with
underscore); the call raises 'Undefined subroutine &main::unpackValueQ'
and the script exits with status 255.
Library callers of IO::Compress and IO::Uncompress are not affected;
the defect is in the bundled CLI tool.
Problem types
-------------
- CWE-755 Improper Handling of Exceptional Conditions
Solutions
---------
Upgrade to IO-Compress 2.220 or later.
References
----------
https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7.patch
https://metacpan.org/release/PMQS/IO-Compress-2.220/changes
Timeline
--------
- 2026-05-14: Issue reported.
- 2026-05-16: Version 2.220 released.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
