/ 
IO-Compress-2.060
/ zipdetails
Security Advisories (4)
CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2025-15649 (2026-05-27)

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.

CVE-2026-48959 (2026-05-27)

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.

CVE-2026-48962 (2026-05-27)

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl. Arbitrary Perl in the output glob executes at the calling process's privilege.

NAME

zipdetails - display the internal structure of zip files

SYNOPSIS

    zipdetaile [-v] zipfile.zip
	zipdetails -h

DESCRIPTION

Zipdetails displays information about the internal record structure of the zip file. It is not concerned with displaying any details of the compressed data stored in the zip file.

The program assumes prior understanding of the internal structure of a Zip file. You should have a copy of the Zip APPNOTE file at hand to help understand the output from this program ("SEE ALSO" for details).

OPTIONS

-v

Enable Verbose mode

-h

Display help

By default zipdetails will output the details of the zip file in three columns.

Column 1

This contains the offset from the start of the file in hex.

Column 2

This contains a textual description of the field.

Column 3

If the field contains a numeric value it will be displayed in hex. Zip stored most numbers in little-endian format - the value displayed will have the little-endian encoding removed.

Next, is an optional description of what the value means.

If the -v option is present, column 1 is expanded to include

  • The offset from the start of the file in hex.

  • The length of the filed in hex.

  • A hex dump of the bytes in field in the order they are stored in the zip file.

TODO

Error handling is still a work in progress. If the program encounters a problem reading a zip file it is likely to terminate with an unhelpful error message.

SEE ALSO

The primary reference for Zip files is the "appnote" document available at http://www.pkware.com/documents/casestudies/APPNOTE.TXT.

An alternative is the Info-Zip appnote. This is available from ftp://ftp.info-zip.org/pub/infozip/doc/

The zipinfo program that comes with the info-zip distribution (http://www.info-zip.org/) can also display details of the structure of a zip file.

See also IO::Compress::Zip, IO::Uncompress::Unzip.

AUTHOR

Paul Marquess pmqs@cpan.org.

COPYRIGHT

Copyright (c) 2011-2012 Paul Marquess. All rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.