CVE-2025-15649

Name	CVE-2025-15649
Description	IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1138863, 1146065

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libio-compress-perl (PTS)	bookworm	2.204-1	vulnerable
	trixie	2.213-1	vulnerable
	forky, sid	2.223-1	fixed
perl (PTS)	bookworm	5.36.0-7+deb12u3	vulnerable
	bookworm (security)	5.36.0-7+deb12u2	vulnerable
	trixie	5.40.1-6	vulnerable
	forky, sid	5.42.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libio-compress-perl	source	(unstable)	2.217-1			1146065
perl	source	(unstable)	5.40.1-8			1138863

Notes

[trixie] - libio-compress-perl <no-dsa> (Minor issue)
[trixie] - perl <no-dsa> (Minor issue)
https://lists.security.metacpan.org/cve-announce/msg/40434380/
https://github.com/pmqs/IO-Compress/issues/65
Fixed by: https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8 (v2.215)