Hi,
Three coreutils entries in data/CVE/list look like they have stale version
data. Each correction rests on upstream's own "[bug introduced in ...]"
tags in
NEWS. I checked debian/patches for 9.1-1, 9.7-3 and 9.10-1, and none of them
carries the multi-byte expand/unexpand code early (the series files are only
61_whoips, 63_dd-appenderrors, 72_id_checkngroups and gnulib-nfs-acl).
1. CVE-2026-56392 (unexpand -t heap overflow), fixed upstream in
b60a159fdc5b.
NEWS for 9.12 says: "'unexpand -t' no longer overflows a heap buffer ...
[bugs introduced in coreutils-9.11]". The vulnerable code arrived with
multi-byte expand/unexpand support in 9.11 ("'expand' and 'unexpand' now
support multi-byte characters."). Debian ships 9.1, 9.7 and 9.10, so no
suite is affected. Suggested entry:
- coreutils <not-affected> (Vulnerable code introduced in 9.11)
2. CVE-2026-56391 (uniq -w read overrun), fixed upstream in d64e35a8a4c0.
NEWS for 9.12 says: "'uniq -w' no longer overruns the read buffer in
multibyte locales. [bug introduced in coreutils-9.5]". Bookworm's 9.1-1
predates that; trixie (9.7) and sid (9.10) are affected. Suggested
addition:
[bookworm] - coreutils <not-affected> (Vulnerable code introduced
in 9.5)
3. CVE-2025-5278 (sort key-offset heap under-read, #1106733), fixed
upstream in
8c9602e3a145, which shipped in coreutils 9.8 (2025-09-22). sid's first
upload at or above 9.8 is 9.10-1. The tracker still lists sid as unfixed.
Suggested change to the unstable line:
- coreutils 9.10-1 (unimportant; bug #1106733)
#1106733 could also be closed with version 9.10-1.
References:
https://cgit.git.savannah.gnu.org/cgit/coreutils.git/plain/NEWS
https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371
https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633
Thanks,
Josh Spork
