Secunia

A vulnerability has been reported in the Archive::Zip Perl module, which potentially can be exploited by malware to bypass certain scanning functionality.

The vulnerability is caused due to an error when parsing .zip archive headers. This can be exploited via a specially crafted .zip archive where the uncompressed size of the archived file has been modified within the local and global headers.

Successful exploitation allows malware in a specially crafted .zip archive to bypass the scanning functionality of an Anti-Virus application, which uses the Archive::Zip Perl module for decompression.

The vulnerability has been reported in version 1.13. Other versions may also be affected.

Solution
Update to version 1.14:
Further details available in Customer Area

Provided and/or discovered by
Originally discovered by anonymous person and reported via iDEFENSE.

Reported in Archive::Zip by:
jester71

Changelog
Further details available in Customer Area

Original Advisory
http://rt.cpan.org/NoAuth/Bug.html?id=8077

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area