AZL-89283
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-89283.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-89283
- Upstream
- Published
- 2026-05-27T04:16:23Z
- Modified
- 2026-08-29T05:27:27Z
- Summary
- CVE-2025-15649 affecting package perl for versions less than 5.38.2-512
- Details
-
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.
_dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die.
The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
- References