perl-IO-Compress-2.081-2.el8_10
エラータID: AXSA:2026-1105:01
リリース日:
2026/06/30 Tuesday - 17:48
題名:
perl-IO-Compress-2.081-2.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- perl-IO-Compress には、ローカルの攻撃者により、巧妙に細工
された glob を介して、影響を受けるプロセスの権限で任意の perl
コードの実行を可能とする脆弱性が存在します。(CVE-2026-48962)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-48962
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.
追加情報:
N/A
ダウンロード:
SRPMS
- perl-IO-Compress-2.081-2.el8_10.src.rpm
MD5: 4e1ba127eaf45bef5da38cac601293ff
SHA-256: 22f4ccaccea273366baa6051808303054474868875dfea216b61351f90517b6a
Size: 264.90 kB
Asianux Server 8 for x86_64
- perl-IO-Compress-2.081-2.el8_10.noarch.rpm
MD5: e65b68986729becf90dbd99b17a6b911
SHA-256: 094dde288c4a0e31366445865012aba57112216e08fb4ed2898d8e78e2d0152c
Size: 257.46 kB
English