[From nobody Sat Jun  6 18:35:14 2026
Received: (at submit) by bugs.debian.org; 27 May 2026 15:18:03 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-11.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
 MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 27; hammy, 150; neutral, 68; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wSG19-00ASmT-2N
 for submit@bugs.debian.org; Wed, 27 May 2026 15:18:03 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libio-compress-perl: CVE-2026-48961
Message-ID: <177989507910.3125805.2734910851017882009.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Wed, 27 May 2026 17:17:59 +0200
Delivered-To: submit@bugs.debian.org

Source: libio-compress-perl
Version: 2.219-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for libio-compress-perl.

CVE-2026-48961[0]:
| IO::Compress versions from 2.207 before 2.220 for Perl ship a
| zipdetails CLI tool that crashes with undefined subroutine on Info-
| ZIP Unix Extra Field with 8-byte UID or GID.  When decode_ux() in
| bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875)
| with UID Size or GID Size set to 8, causing zipdetails to decode an
| 8-byte UID or GID value, it dispatches through decodeLitteEndian(),
| which calls a misnamed helper unpackValueQ. The actual function
| defined in the same file is unpackValue_Q (with underscore); the
| call raises 'Undefined subroutine &main::unpackValueQ' and the
| script exits with status 255.  Library callers of IO::Compress and
| IO::Uncompress are not affected; the defect is in the bundled CLI
| tool.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-48961
    https://www.cve.org/CVERecord?id=CVE-2026-48961
[1] https://lists.security.metacpan.org/cve-announce/msg/40434383/
[2] https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
]