-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 17:20:53 +0200
Source: libio-compress-perl
Architecture: source
Version: 2.213-1+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1138051 1138052 1138055 1146065
Changes:
 libio-compress-perl (2.213-1+deb13u1) trixie; urgency=medium
 .
   * [Security] CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
     (Closes: #1146065)
   * [Security] CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
     (Closes: #1138051)
   * [Security] CVE-2026-48961: crash in zipdetails.
     (Closes: #1138052)
   * [Security] CVE-2026-48962: code execution in IO-Compress via output
     globs.
     (Closes: #1138055)
   * Add debian/source/include-binaries for CVE-2025-15649 test case.
Checksums-Sha1:
 fc4bc97cc4cfd6cd3659a460056ac7f316426c85 2648 libio-compress-perl_2.213-1+deb13u1.dsc
 5e98b25e3c48216dae342d1751b78515f6f0dd59 10444 libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Checksums-Sha256:
 b761c9afa8138679201bcf9d55b7d82f09672a069fefd4d8e930514743373974 2648 libio-compress-perl_2.213-1+deb13u1.dsc
 01d4a6d5f838133cde95d05687353654e890df00aea22ac72e29872e48dbbba9 10444 libio-compress-perl_2.213-1+deb13u1.debian.tar.xz
Files:
 c01f924f28bcf2199aaaeeb7eadf82da 2648 perl optional libio-compress-perl_2.213-1+deb13u1.dsc
 ce5e74536028a6f2938b9eace5e16123 10444 perl optional libio-compress-perl_2.213-1+deb13u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmqXSWxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgZqLA/+O1vZOnjgeNOMGrAcsMLXrHjF4Sz7jxcaa2XA6q9Ts8CpjFNP2wmZOu4K
uvTGGzEI6KYV7r1VzEDA9m9WeYwUz9kiK2RTyl4AB0MIWqpWivUvpaPiNVuQajkG
Fc9my5O6W89N7lXoFjS/1VTJRpolrTKcHUj5WAKYw61HFI0VgrDOVmP2uH7wUWYP
n9TKSM/7W/s0I3D0ABVoFjoRzc/gWvH5F6ylAA8o4z5+S4OzcEvKFXxyO4XCVY/P
heygV36XtGLXCpi6hzXACsjvdT2OHurXBAmOg9LsC2vtKIEOpIW6NifgzKcQPpz1
cEsAKBQHwe4H9VhpYopPK+DS39pdsmEto5C/KfBA7WJnHsRwwawapWDYv3Qi0WhZ
4YntHUIbbH9O9nSBImeO5ooKegn/f/OIb0KCR3DYVo5cUjnB8nmdl81lIUZJZ7o0
ja5uBpaI01FNz0y6XzsOwfACoU0I6m4jbXGh9tspc38L7lIaWzwfq1ELxSJztsvT
JGX+Vd/tpCmt7hvqQi8Tu2M2Jy5b1KU9+xZJVEdni3oMb2udvLqOOslMh5d6HxOI
TcMKKim1LUK4oeZ7YOr/l4S05iQBR/+4n6JsyCD/jCpHgYuLI1zqgO9QXeI4hXiV
yi4gjUGuDA2H6KToBqqF1i4MsInXrZqLigmw7oe/DPMrGVoiRr0=
=lcdZ
-----END PGP SIGNATURE-----