[From nobody Wed Sep 2 22:19:05 2026 Received: (at 1138055-close) by bugs.debian.org; 2 Sep 2026 21:17:08 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 64; hammy, 150; neutral, 157; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:48948) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x1sKR-000VR9-25 for 1138055-close@bugs.debian.org; Wed, 02 Sep 2026 21:17:08 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x1sKT-0007iG-11 for 1138055-close@bugs.debian.org; Wed, 02 Sep 2026 21:17:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=uI9NBirWfB7yF8CYQ2n7i78817OcAK2agroR7fefGiU=; b=eTS2HsiJ8ah2P7BOedY+FsQcc4 1E+mFLMNMW0qRZEw4dEI1AYYSfomSo+dCe4JqyGnNpCAD8c8EHjb5PnKzacVcM6AwOVvEJ7ru7BM0 I4vuRbRdkYGHpwM7UO3DSql+IhbS/xNMj/kqer/Ziv+mkAzSBFlbI4bO2amXddmS9C7w9EOfp9pog 9O1UJeaqfRo8kHwoVaaT68RKIkW98roCxXWDE2Dy1mHp7YUV7/r4OqAQ0XqsP7mjFYAJ4pTrk6U8h SZMhMTkEjHHXCw0ymKU3bzk+ycb76NWXq3iy15tqQw4OZxbyRlAygiuYX0TugJMj/Efg67ydmXfcc Mo7PWENg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x1sKR-0000000FPEJ-3zkJ; Wed, 02 Sep 2026 21:17:07 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: gregor herrmann <gregoa@debian.org> To: 1138055-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: libio-compress-perl Debian: DAK Debian-Changes: libio-compress-perl_2.213-1+deb13u1_source.changes Debian-Source: libio-compress-perl Debian-Version: 2.213-1+deb13u1 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1138055: fixed in libio-compress-perl 2.213-1+deb13u1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============6208574612157052736==" Message-Id: <E1x1sKR-0000000FPEJ-3zkJ@fasolo.debian.org> Date: Wed, 02 Sep 2026 21:17:07 +0000 --===============6208574612157052736== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libio-compress-perl Source-Version: 2.213-1+deb13u1 Done: gregor herrmann <gregoa@debian.org> We believe that the bug you reported is fixed in the latest version of libio-compress-perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1138055@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. gregor herrmann <gregoa@debian.org> (supplier of updated libio-compress-perl = package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 31 Aug 2026 17:20:53 +0200 Source: libio-compress-perl Architecture: source Version: 2.213-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1138051 1138052 1138055 1146065 Changes: libio-compress-perl (2.213-1+deb13u1) trixie; urgency=3Dmedium . * [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip. (Closes: #1146065) * [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip. (Closes: #1138051) * [Security] CVE-2026-48961: crash in zipdetails. (Closes: #1138052) * [Security] CVE-2026-48962: code execution in IO-Compress via output globs. (Closes: #1138055) * Add debian/source/include-binaries for CVE-2025-15649 test case. Checksums-Sha1: fc4bc97cc4cfd6cd3659a460056ac7f316426c85 2648 libio-compress-perl_2.213-1+de= b13u1.dsc 5e98b25e3c48216dae342d1751b78515f6f0dd59 10444 libio-compress-perl_2.213-1+d= eb13u1.debian.tar.xz Checksums-Sha256: b761c9afa8138679201bcf9d55b7d82f09672a069fefd4d8e930514743373974 2648 libio-= compress-perl_2.213-1+deb13u1.dsc 01d4a6d5f838133cde95d05687353654e890df00aea22ac72e29872e48dbbba9 10444 libio= -compress-perl_2.213-1+deb13u1.debian.tar.xz Files: c01f924f28bcf2199aaaeeb7eadf82da 2648 perl optional libio-compress-perl_2.21= 3-1+deb13u1.dsc ce5e74536028a6f2938b9eace5e16123 10444 perl optional libio-compress-perl_2.2= 13-1+deb13u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSWxfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ qgZqLA/+O1vZOnjgeNOMGrAcsMLXrHjF4Sz7jxcaa2XA6q9Ts8CpjFNP2wmZOu4K uvTGGzEI6KYV7r1VzEDA9m9WeYwUz9kiK2RTyl4AB0MIWqpWivUvpaPiNVuQajkG Fc9my5O6W89N7lXoFjS/1VTJRpolrTKcHUj5WAKYw61HFI0VgrDOVmP2uH7wUWYP n9TKSM/7W/s0I3D0ABVoFjoRzc/gWvH5F6ylAA8o4z5+S4OzcEvKFXxyO4XCVY/P heygV36XtGLXCpi6hzXACsjvdT2OHurXBAmOg9LsC2vtKIEOpIW6NifgzKcQPpz1 cEsAKBQHwe4H9VhpYopPK+DS39pdsmEto5C/KfBA7WJnHsRwwawapWDYv3Qi0WhZ 4YntHUIbbH9O9nSBImeO5ooKegn/f/OIb0KCR3DYVo5cUjnB8nmdl81lIUZJZ7o0 ja5uBpaI01FNz0y6XzsOwfACoU0I6m4jbXGh9tspc38L7lIaWzwfq1ELxSJztsvT JGX+Vd/tpCmt7hvqQi8Tu2M2Jy5b1KU9+xZJVEdni3oMb2udvLqOOslMh5d6HxOI TcMKKim1LUK4oeZ7YOr/l4S05iQBR/+4n6JsyCD/jCpHgYuLI1zqgO9QXeI4hXiV yi4gjUGuDA2H6KToBqqF1i4MsInXrZqLigmw7oe/DPMrGVoiRr0=3D =3DlcdZ -----END PGP SIGNATURE----- --===============6208574612157052736== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapiSUwAKCRCb9qggYcy5 IQBjAQDNcyif5Fa3OI6jfNxVJdz/26T6U7LZcDMfUtAtND0veAD/c6Jby8Xe5uOD xwaA/cWV6Oukv6HU8xpn1lSCziEdZA8= =vjMq -----END PGP SIGNATURE----- --===============6208574612157052736==-- ]