Simon Quigley pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e5fda4f0 by Simon Quigley at 2026-10-08T11:15:05-05:00
libgit2: triage some CVE entries, add a note in dla-needed.txt
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -87327,6 +87327,7 @@ CVE-2026-60074 (Date::Manip versions through 7.00 for
Perl return corrupted date
CVE-2026-53587 (libgit2 is a portable C implementation of the Git core methods
provide ...)
{DSA-6453-1}
- libgit2 1.9.6+ds-1
+ [bookworm] - libgit2 <not-affected> (Vulnerable code introduced later;
object-format capability parsing added in 1.6.1)
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3
(v1.9.5)
CVE-2026-53586 (libgit2 is a portable C implementation of the Git core methods
provide ...)
@@ -87347,6 +87348,7 @@ CVE-2026-53584 (libgit2 is a portable C implementation
of the Git core methods p
CVE-2026-53583 (libgit2 is a portable C implementation of the Git core methods
provide ...)
{DSA-6453-1}
- libgit2 1.9.6+ds-1
+ [bookworm] - libgit2 <not-affected> (Vulnerable code not built;
Bookworm uses the mbedTLS backend, not OpenSSL)
NOTE:
https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp
NOTE: Fixed by:
https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f
(v1.9.5)
CVE-2026-62268
=====================================
data/dla-needed.txt
=====================================
@@ -346,6 +346,7 @@ libgd-securityimage-perl
libgit2 (Simon Quigley)
NOTE: 20260801: Added by Front-Desk (ta)
NOTE: 20260801: not sure whether Bullseye and Bookworm are really affected,
please recheck (ta)
+ NOTE: 20261008: Bookworm is indeed affected by all but two CVEs currently
open (tsimonq2)
--
libheif
NOTE: 20260612: Added by Front-Desk (rouca)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e5fda4f0c6a330341f8b559c26c84f0665769e22
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e5fda4f0c6a330341f8b559c26c84f0665769e22
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
