Description (CNA)
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| PMQS / IO::Uncompress::Unzip | affected 0 before 2.215 |
CWE
CWE-248
References
- https://github.com/pmqs/IO-Compress/commit/fd28c1d2374eee9811f6d0c5bddc0957abdf1da8.patch
- https://github.com/pmqs/IO-Compress/issues/65
- https://metacpan.org/release/PMQS/IO-Compress-2.215/changes
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.