Debian alert DLA-4812-1 (libio-compress-perl)

From:
             
 
Arnaud Rebillout <arnaudr@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4812-1] libio-compress-perl security update
Date:
             
 
Fri, 02 Oct 2026 08:40:17 +0700
Message-ID:
             
 
<1c9d376c65872420b3b4ba3ce1ca8320@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4812-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                     Arnaud Rebillout
October 02, 2026                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libio-compress-perl
Version        : 2.204-1+deb12u1
CVE ID         : CVE-2025-15649 CVE-2026-48959 CVE-2026-48962
Debian Bug     : 1138051 1138055 1146065

Multiple vulnerabilities were discovered in libio-compress-perl, a Perl
library to allow reading and writing of compressed data.

CVE-2025-15649

    Uncaught exception when parsing zip header with malformed DOS date.

CVE-2026-48959

    CPU exhaustion via per-byte read loop in fastForward.

CVE-2026-48962

    Arbitrary code in File::GlobMapper via an attacker-controlled output
    glob.

For Debian 12 bookworm, these problems have been fixed in version
2.204-1+deb12u1.

We recommend that you upgrade your libio-compress-perl packages.

For the detailed security status of libio-compress-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libio-compres...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmq/C3wACgkQ5yXoeRRg
AhYoDQ//WgriIIPQZMaYr7K9yTPAGso4GyPc0khIH+bb9KeuOQ6NgjwkjMxeT6pa
PCrhwb/xfo55peHFpDroNIE14U/Gnn7RT0iMEFR0M0M7F6nzHveeZxrof4Yy6Riz
9LgPnDeWRqgUcnbSP5Ct/2l/I+TyXWX+o7Q7jnaahfQmH3NEWRUAroNjqP12uET4
pruS8vpo3nCp/RQUh/xQnOMH57dwT/nb49voVGsrHZl3uLdn0fzwmJANp1ZztMOl
QGdAZe4oPgDBwdGqcNDOmqWZyN4a3Kag7pWmdAD6RR/GC+Ni/5XV10eTfsQGyliz
biSAsX6xvbd2HFwcN+3Kf+9v50XVDPQiqduUXfzvhStgrdKs/G35EM38uOlBtVna
+AcTE/l/BsZD7zUAA/QkYagcnb4zPhFUQpeCN94YFLG0Wyf79rOaeHvJMdKidUpA
cQRpdl1xnD08lIB1IlTCGmsR+1Cqxdlrxd2ReOUTaqpKCqCIkuNDDvzunH5ag86z
Ymz4Z8QSQIDU1yo47bMqouPo6QQfL1zQ9zrvGDJn0unjxI9Pzzn0W8BmsINu5sNR
gREExWXOdV1tOMFSnZ7rfSkN+1HLT/XLkoApUN10pnw8DEtVUoUi3h0lIWS96p9y
Z9KrQc4vDdoAik+r0TZI0/Ufa29QF31pGm/Z97TuLoRlnayKANQ=
=xcXd
-----END PGP SIGNATURE-----