You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
This CVE record is not being prioritized for NVD enrichment efforts due to resource or other concerns.
Description
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.
When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.
Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: IO::Compress de PMQS, Description: Las versiones de IO::Compress desde la 2.207 anteriores a la 2.220 para Perl distribuyen una herramienta CLI zipdetails que falla con subrutina indefinida en el campo extra Unix de Info-ZIP con UID o GID de 8 bytes.
Cuando decode_ux() en bin/zipdetails maneja un campo extra Unix de Info-ZIP (etiqueta 0x7875) con el tamaño de UID o el tamaño de GID establecido en 8, lo que hace que zipdetails decodifique un valor UID o GID de 8 bytes, se despacha a través de decodeLitteEndian(), que llama a una función auxiliar mal nombrada unpackValueQ. La función real definida en el mismo archivo es unpackValue_Q (con guion bajo); la llamada genera 'Undefined subroutine &main::unpackValueQ' y el script sale con estado 255.
Los llamadores de biblioteca de IO::Compress y IO::Uncompress no se ven afectados; el defecto está en la herramienta CLI incluida.
Title: IO::Compress de PMQS, Description: Las versiones de IO::Compress desde la 2.207 anteriores a la 2.220 para Perl distribuyen una herramienta CLI zipdetails que falla con subrutina indefinida en el campo extra Unix de Info-ZIP con UID o GID de 8 bytes.
Cuando decode_ux() en bin/zipdetails maneja un campo extra Unix de Info-ZIP (etiqueta 0x7875) con el tamaño de UID o el tamaño de GID establecido en 8, lo que hace que zipdetails decodifique un valor UID o GID de 8 bytes, se despacha a través de decodeLitteEndian(), que llama a una función auxiliar mal nombrada unpackValueQ. La función real definida en el mismo archivo es unpackValue_Q (con guion bajo); la llamada genera 'Undefined subroutine &main::unpackValueQ' y el script sale con estado 255.
Los llamadores de biblioteca de IO::Compress y IO::Uncompress no se ven afectados; el defecto está en la herramienta CLI incluida.
CVE Translated by NIST7/23/2026 7:10:00 AM
Action
Type
Old Value
New Value
Added
Translation
Title: IO::Compress de PMQS, Description: Las versiones de IO::Compress desde la 2.207 anteriores a la 2.220 para Perl distribuyen una herramienta CLI zipdetails que falla con subrutina indefinida en el campo extra Unix de Info-ZIP con UID o GID de 8 bytes.
Cuando decode_ux() en bin/zipdetails maneja un campo extra Unix de Info-ZIP (etiqueta 0x7875) con el tamaño de UID o el tamaño de GID establecido en 8, lo que hace que zipdetails decodifique un valor UID o GID de 8 bytes, se despacha a través de decodeLitteEndian(), que llama a una función auxiliar mal nombrada unpackValueQ. La función real definida en el mismo archivo es unpackValue_Q (con guion bajo); la llamada genera 'Undefined subroutine &main::unpackValueQ' y el script sale con estado 255.
Los llamadores de biblioteca de IO::Compress y IO::Uncompress no se ven afectados; el defecto está en la herramienta CLI incluida.
New CVE Received from CPANSec5/27/2026 12:16:31 AM
Action
Type
Old Value
New Value
Added
Description
IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID.
When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag 0x7875) with UID Size or GID Size set to 8, causing zipdetails to decode an 8-byte UID or GID value, it dispatches through decodeLitteEndian(), which calls a misnamed helper unpackValueQ. The actual function defined in the same file is unpackValue_Q (with underscore); the call raises 'Undefined subroutine &main::unpackValueQ' and the script exits with status 255.
Library callers of IO::Compress and IO::Uncompress are not affected; the defect is in the bundled CLI tool.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
