Описание
Security update for perl-IO-Compress
This update for perl-IO-Compress fixes the following issues:
Changes in perl-IO-Compress:
-
updated to 2.220.0 (2.220) see /usr/share/doc/packages/perl-IO-Compress/Changes
2.220 16 May 2026 * remove use of eval in globmapper. #73 CVE-2026-48962 bsc#1266382 * Update zipdetails to version 4.006. CVE-2026-48961 bsc#1266381 * Fix typo in fastForward #72 * Fix issue with "rawdeflate` option in AnyInflate. #71
-
updated to 2.219.0 (2.219) see /usr/share/doc/packages/perl-IO-Compress/Changes
2.219 9 March 2026 * Fix a few typos * Squash repeated semicolons * Make dependent version checking consistent amd update module to version 2.219. Fixes #70 2.218 8 March 2026 * Refresh zipdetails to version 4.005 Sourced from https://github.com/pmqs/zipdetails * version 2.218 * Add SECURITY.md, Fixes #69 * fix spelling typo * Refresh Changes file * Update release date in README * Refresh zipdetails from https://github.com/pmqs/zipdetails 2.217 1 February 2026 * Update release date in README * Refresh zipdetails from https://github.com/pmqs/zipdetails * Delete GZIP environment variable before running interop tests Fixes #24 * Update version to 2.217 2.216 31 January 2026 * Update version to 2.216 * IO::Compress @2.215: t/006zip.t fails due to missing test files #67 2.215 31 January 2026 * Fix version check in 000prereq.t * Update Changes for 2.215 * Update version to 2.215 & change copyright year to 2026 * Add tests for handling zero and invalid datetime values in unzip functionality. Fix for #65 * Enhance _dosToUnixTime to handle zero and invalid datetime values; add tests for edge cases. Fixes #65
-
updated to 2.214.0 (2.214) see /usr/share/doc/packages/perl-IO-Compress/Changes
2.214 24 October 2025 * version 2.214 * IO::Compress::Gzip accidentally modifies the
$EXPORT_TAGS{all}->@*of other modules Fixes #64 * Fix indentation in Windows workflow YAML * Fix indentation in windows.yml exclude section * Merge pull request #63 from masiuchi/fix/ci-errors * Exclude Perl 5.42 with "strawberry" distribution from GitHub Actions * Update FreeBSD image to 14.3 in Cirrus CI * Add dependabot.yml file to police workflow files * Add perl 5.42 to workflow files * Fix for https://github.com/pmqs/Compress-Raw-Zlib/issues/34 * #59 fix typos in streamzip
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1266381
- SUSE Bug 1266382
- SUSE CVE CVE-2026-48961 page
- SUSE CVE CVE-2026-48962 page
Описание
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255. Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
Затронутые продукты
Ссылки
- CVE-2026-48961
- SUSE Bug 1266381
Описание
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
Затронутые продукты
Ссылки
- CVE-2026-48962
- SUSE Bug 1266382