Approved changes feed: RSS · Atom
cpe:2.3:a:pmqs:io::uncompress::unzip:*:*:*:*:*:*:*:*
part: a version: * update: uncompress
| Vendor | Pmqs (94bd7034-9bd6-5dac-938e-6849dd761668) |
|---|---|
| Product | Io (b0212d05-d8c5-5273-88e8-bc9236c13b4b) |
| Edition | * |
| Language | unzip |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48959 |
vulnerable | 2026-06-08 08:05:12.375322 |
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.
fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.
Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
Published: 2026-05-27T02:29:07.027Z
Updated: 2026-05-29T15:50:39.869Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15649 |
vulnerable | 2026-06-08 07:06:36.595914 |
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.
The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
Published: 2026-05-27T02:25:38.973Z
Updated: 2026-05-29T15:49:21.186Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.