Version in base suite: 2.213-1 Base version: libio-compress-perl_2.213-1 Target version: libio-compress-perl_2.213-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libi/libio-compress-perl/libio-compress-perl_2.213-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libi/libio-compress-perl/libio-compress-perl_2.213-1+deb13u1.dsc /srv/release.debian.org/tmp/Nwhpvzr0US/libio-compress-perl-2.213/debian/patches/CVE-2025-15649.diff |binary libio-compress-perl-2.213/debian/changelog | 15 libio-compress-perl-2.213/debian/patches/CVE-2025-15649-tests.diff | 70 ++++ libio-compress-perl-2.213/debian/patches/CVE-2026-48959.diff | 29 + libio-compress-perl-2.213/debian/patches/CVE-2026-48961.diff | 27 + libio-compress-perl-2.213/debian/patches/CVE-2026-48962.diff | 166 ++++++++++ libio-compress-perl-2.213/debian/patches/series | 5 libio-compress-perl-2.213/debian/source/include-binaries | 1 8 files changed, 313 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp343dgmry/libio-compress-perl_2.213-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp343dgmry/libio-compress-perl_2.213-1+deb13u1.dsc: no acceptable signature found diff -Nru libio-compress-perl-2.213/debian/changelog libio-compress-perl-2.213/debian/changelog --- libio-compress-perl-2.213/debian/changelog 2024-09-01 14:58:10.000000000 +0000 +++ libio-compress-perl-2.213/debian/changelog 2026-08-31 15:20:53.000000000 +0000 @@ -1,3 +1,18 @@ +libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium + + * [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip. + (Closes: #1146065) + * [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip. + (Closes: #1138051) + * [Security] CVE-2026-48961: crash in zipdetails. + (Closes: #1138052) + * [Security] CVE-2026-48962: code execution in IO-Compress via output + globs. + (Closes: #1138055) + * Add debian/source/include-binaries for CVE-2025-15649 test case. + + -- gregor herrmann Mon, 31 Aug 2026 17:20:53 +0200 + libio-compress-perl (2.213-1) unstable; urgency=medium * Import upstream version 2.213. diff -Nru libio-compress-perl-2.213/debian/patches/CVE-2025-15649-tests.diff libio-compress-perl-2.213/debian/patches/CVE-2025-15649-tests.diff --- libio-compress-perl-2.213/debian/patches/CVE-2025-15649-tests.diff 1970-01-01 00:00:00.000000000 +0000 +++ libio-compress-perl-2.213/debian/patches/CVE-2025-15649-tests.diff 2026-08-31 15:20:53.000000000 +0000 @@ -0,0 +1,70 @@ +From: pmqs +Date: Sat, 25 Oct 2025 19:52:01 +0100 +Subject: Add tests for handling zero and invalid datetime values in unzip + functionality. Fix for #65 + +(Backported for Debian by Niko Tyni) + +Origin: backport, https://github.com/pmqs/IO-Compress/commit/739698a7b1bb6814d1aa3c4a1b81374b16a9fea5 +Bug: https://github.com/pmqs/IO-Compress/issues/65 +Bug-Debian: https://bugs.debian.org/1146065 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-15649 +--- + t/006zip.t | 40 +++++++++++++++++++++++++++++++++++++++- + 1 file changed, 39 insertions(+), 1 deletion(-) + +diff --git a/t/006zip.t b/t/006zip.t +index 580d950..f975e36 100644 +--- a/t/006zip.t ++++ b/t/006zip.t +@@ -19,7 +19,7 @@ BEGIN { + $extra = 1 + if eval { require Test::NoWarnings ; Test::NoWarnings->import; 1 }; + +- plan tests => 108 + $extra ; ++ plan tests => 115 + $extra ; + + use_ok('IO::Compress::Zip', qw(:all)) ; + use_ok('IO::Uncompress::Unzip', qw(unzip $UnzipError)) ; +@@ -402,3 +402,41 @@ EOM + + is $line, qq["key","value"\n], "got line 1 from second member"; + } ++ ++ ++{ ++ title "bad datetime"; ++ # https://github.com/pmqs/IO-Compress/issues/65 ++ ++ { ++ # files/time-zero.zip has the modification time set to zero ++ my $file1 = "t/files/time-zero.zip"; ++ my $u = IO::Uncompress::Unzip->new( $file1) ++ or die "Cannot open $file1: $UnzipError"; ++ ++ isa_ok $u, "IO::Uncompress::Unzip"; ++ ++ my $name = $u->getHeaderInfo()->{Name}; ++ ++ my $hdr = $u->getHeaderInfo(); ++ is $hdr->{Name}, 'hello.txt', "Name is 'hello.txt'"; ++ is $hdr->{Time}, 0, "Time is zero"; ++ } ++ ++ ++ { ++ # files/time-invalid.zip has the modification time set to an invalid date ++ my $file1 = "t/files/time-invalid.zip"; ++ my $u = IO::Uncompress::Unzip->new( $file1) ++ or die "Cannot open $file1: $UnzipError"; ++ ++ isa_ok $u, "IO::Uncompress::Unzip"; ++ ++ my $name = $u->getHeaderInfo()->{Name}; ++ ++ my $hdr = $u->getHeaderInfo(); ++ is $hdr->{Name}, 'hello.txt', "Name is 'hello.txt'"; ++ is $hdr->{Time}, 0, "Time is zero"; ++ } ++ ++} Binary files /srv/release.debian.org/tmp/gojNT0owTx/libio-compress-perl-2.213/debian/patches/CVE-2025-15649.diff and /srv/release.debian.org/tmp/Nwhpvzr0US/libio-compress-perl-2.213/debian/patches/CVE-2025-15649.diff differ diff -Nru libio-compress-perl-2.213/debian/patches/CVE-2026-48959.diff libio-compress-perl-2.213/debian/patches/CVE-2026-48959.diff --- libio-compress-perl-2.213/debian/patches/CVE-2026-48959.diff 1970-01-01 00:00:00.000000000 +0000 +++ libio-compress-perl-2.213/debian/patches/CVE-2026-48959.diff 2026-08-31 15:20:53.000000000 +0000 @@ -0,0 +1,29 @@ +From: pmqs +Date: Fri, 15 May 2026 23:18:39 +0100 +Subject: Fix typo in fastForward #72 + +(Backported for Debian by Niko Tyni) + +Origin: backport, https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2 +Bug: https://github.com/pmqs/IO-Compress/issues/72 +Bug-Debian: https://bugs.debian.org/1138051 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-48959 +--- + lib/IO/Uncompress/Unzip.pm | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/IO/Uncompress/Unzip.pm b/lib/IO/Uncompress/Unzip.pm +index 802ee3c..65befa8 100644 +--- a/lib/IO/Uncompress/Unzip.pm ++++ b/lib/IO/Uncompress/Unzip.pm +@@ -157,8 +157,8 @@ sub fastForward + + while ($offset > 0) + { +- $c = length $offset +- if length $offset < $c ; ++ $c = $offset ++ if $offset < $c ; + + $offset -= $c; + diff -Nru libio-compress-perl-2.213/debian/patches/CVE-2026-48961.diff libio-compress-perl-2.213/debian/patches/CVE-2026-48961.diff --- libio-compress-perl-2.213/debian/patches/CVE-2026-48961.diff 1970-01-01 00:00:00.000000000 +0000 +++ libio-compress-perl-2.213/debian/patches/CVE-2026-48961.diff 2026-08-31 15:20:53.000000000 +0000 @@ -0,0 +1,27 @@ +From: Jah-yee <166608075+Jah-yee@users.noreply.github.com> +Date: Sun, 8 Mar 2026 14:53:15 +0000 +Subject: fix: correct unpackValueQ -> unpackValue_Q typo in decodeLitteEndian + +(Backported for Debian by Niko Tyni) + +Origin: backport, https://github.com/pmqs/zipdetails/commit/42da886f43ebd2a8c613ad431208b8df20c9cc22 +Bug: https://github.com/pmqs/zipdetails/pull/32 +Bug-Debian: https://bugs.debian.org/1138052 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-48961 +--- + bin/zipdetails | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/bin/zipdetails b/bin/zipdetails +index 7dd1f55..9564bab 100644 +--- a/bin/zipdetails ++++ b/bin/zipdetails +@@ -4981,7 +4981,7 @@ sub decodeLitteEndian + + if (length $value == 8) + { +- return unpackValueQ ($value) ++ return unpackValue_Q ($value) + } + elsif (length $value == 4) + { diff -Nru libio-compress-perl-2.213/debian/patches/CVE-2026-48962.diff libio-compress-perl-2.213/debian/patches/CVE-2026-48962.diff --- libio-compress-perl-2.213/debian/patches/CVE-2026-48962.diff 1970-01-01 00:00:00.000000000 +0000 +++ libio-compress-perl-2.213/debian/patches/CVE-2026-48962.diff 2026-08-31 15:20:53.000000000 +0000 @@ -0,0 +1,166 @@ +From: pmqs +Date: Sat, 16 May 2026 17:48:34 +0100 +Subject: remove use of eval in globmapper. #73 + +(Backported for Debian by Niko Tyni) + +Origin: backport, https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610 +Bug: https://github.com/pmqs/IO-Compress/issues/73 +Bug-Debian: https://bugs.debian.org/1138055 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-48962 +--- + lib/File/GlobMapper.pm | 52 +++++++++++++++++++++++++++------ + t/globmapper.t | 52 ++++++++++++++++++++++++++++++++- + 2 files changed, 94 insertions(+), 10 deletions(-) + +diff --git a/lib/File/GlobMapper.pm b/lib/File/GlobMapper.pm +index 53f957a..6454bc4 100644 +--- a/lib/File/GlobMapper.pm ++++ b/lib/File/GlobMapper.pm +@@ -29,6 +29,11 @@ our ($VERSION, @EXPORT_OK); + $VERSION = '1.001'; + @EXPORT_OK = qw( globmap ); + ++our $BEGIN_DELIM = "\xFF"; ++our $END_DELIM = "\xFE"; ++our $BACKSLASH_ESC = "\xFD"; ++our $HASH_ESC = "\xFC"; ++our $STAR_ESC = "\xFB"; + + our ($noPreBS, $metachars, $matchMetaRE, %mapping, %wildCount); + $noPreBS = '(?{InputPattern}'\n"; ++ # print "OUTPUT '$self->{OutputGlob}' => '$string'\n"; + +- #print "OUTPUT '$self->{OutputGlob}' => '$string'\n"; + $self->{OutputPattern} = $string ; + + return 1 ; +@@ -335,11 +349,31 @@ sub _getFiles + next if $inFiles{$inFile} ++ ; + + my $outFile = $inFile ; ++ my @matches ; ++ ++ my $noPreESC = '(?{InputPattern}/ ) ++ if (@matches = ($inFile =~ m/$self->{InputPattern}/ )) + { +- no warnings 'uninitialized'; +- eval "\$outFile = $self->{OutputPattern};" ; ++ $outFile = $self->{OutputPattern}; ++ my $ix = 1; ++ ++ # get the filename glob ++ $outFile =~ s/${noPreESC}${BEGIN_DELIM}${END_DELIM}/$inFile/g; ++ ++ # now each of the #1, #2,... ++ for my $pattern (@matches) ++ { ++ $outFile =~ s/${noPreESC}${BEGIN_DELIM}${ix}${END_DELIM}/$pattern/g; ++ ++ ++ $ix; ++ } ++ ++ # unescape ++ $outFile =~ s/${BEGIN_DELIM}${BEGIN_DELIM}/${BEGIN_DELIM}/g; ++ $outFile =~ s/${END_DELIM}${END_DELIM}/${END_DELIM}/g; ++ $outFile =~ s/${HASH_ESC}/#/g; ++ $outFile =~ s/${STAR_ESC}/*/g; + + if (defined $outInMapping{$outFile}) + { +diff --git a/t/globmapper.t b/t/globmapper.t +index 75fa768..842562f 100644 +--- a/t/globmapper.t ++++ b/t/globmapper.t +@@ -24,7 +24,7 @@ Perl $]" ) + $extra = 1 + if eval { require Test::NoWarnings ; Test::NoWarnings->import; 1 }; + +- plan tests => 68 + $extra ; ++ plan tests => 76 + $extra ; + + use_ok('File::GlobMapper') ; + } +@@ -290,6 +290,56 @@ Perl $]" ) + ], " got mapping"; + } + ++{ ++ title "check escaping"; ++ ++ my $tmpDir ;#= 'td'; ++ my $lex = LexDir->new( $tmpDir ); ++ ++ my $BEGIN_DELIM = "\xFF"; ++ my $END_DELIM = "\xFE"; ++ ++ #mkdir $tmpDir, 0777 ; ++ ++ touch map { "$tmpDir/$_.tmp" } qw( abc1 abc2 abc3 ) ; ++ ++ my $map = File::GlobMapper::globmap("$tmpDir/*b*.tmp", "$tmpDir/X-${BEGIN_DELIM}#2-#1${END_DELIM}-X"); ++ ok $map, " got map" ++ or diag $File::GlobMapper::Error ; ++ ++ is @{ $map }, 3, " returned 3 maps"; ++ is_deeply $map, ++ [ [map { "$tmpDir/$_" } ("abc1.tmp", "X-${BEGIN_DELIM}c1-a${END_DELIM}-X")], ++ [map { "$tmpDir/$_" } ("abc2.tmp", "X-${BEGIN_DELIM}c2-a${END_DELIM}-X")], ++ [map { "$tmpDir/$_" } ("abc3.tmp", "X-${BEGIN_DELIM}c3-a${END_DELIM}-X")], ++ ], " got mapping"; ++} ++ ++{ ++ title "check backslash escaping"; ++ ++ my $tmpDir ;#= 'td'; ++ my $lex = LexDir->new( $tmpDir ); ++ ++ my $BEGIN_DELIM = "\xFF"; ++ my $END_DELIM = "\xFE"; ++ ++ #mkdir $tmpDir, 0777 ; ++ ++ touch map { "$tmpDir/$_.tmp" } qw( abc1 abc2 abc3 ) ; ++ ++ my $map = File::GlobMapper::globmap("$tmpDir/*b*.tmp", $tmpDir . '/X-#2-\\#1\\*-X'); ++ ok $map, " got map" ++ or diag $File::GlobMapper::Error ; ++ ++ is @{ $map }, 3, " returned 3 maps"; ++ is_deeply $map, ++ [ [map { "$tmpDir/$_" } ("abc1.tmp", "X-c1-#1*-X")], ++ [map { "$tmpDir/$_" } ("abc2.tmp", "X-c2-#1*-X")], ++ [map { "$tmpDir/$_" } ("abc3.tmp", "X-c3-#1*-X")], ++ ], " got mapping"; ++} ++ + # TODO + # test each of the wildcard metacharacters can be mapped to the output filename + # diff -Nru libio-compress-perl-2.213/debian/patches/series libio-compress-perl-2.213/debian/patches/series --- libio-compress-perl-2.213/debian/patches/series 2024-09-01 14:58:10.000000000 +0000 +++ libio-compress-perl-2.213/debian/patches/series 2026-08-31 15:20:53.000000000 +0000 @@ -1,2 +1,7 @@ autopkgtest.patch tests-version-skew.patch +CVE-2025-15649-tests.diff +CVE-2025-15649.diff +CVE-2026-48959.diff +CVE-2026-48961.diff +CVE-2026-48962.diff diff -Nru libio-compress-perl-2.213/debian/source/include-binaries libio-compress-perl-2.213/debian/source/include-binaries --- libio-compress-perl-2.213/debian/source/include-binaries 1970-01-01 00:00:00.000000000 +0000 +++ libio-compress-perl-2.213/debian/source/include-binaries 2026-08-31 15:20:53.000000000 +0000 @@ -0,0 +1 @@ +debian/patches/CVE-2025-15649.diff