[From nobody Thu Aug  6 22:59:08 2026
Received: (at 1136042-done) by bugs.debian.org; 6 Aug 2026 21:57:52 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-107.6 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FROMDEVELOPER,SORTED_RECIPS,SPF_HELO_NONE,SPF_PASS,SUSPICIOUS_RECIPS,
 USER_IN_DKIM_WELCOMELIST,VERSION autolearn=unavailable
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 0; hammy, 150; neutral, 64; spammy, 0.
 spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <sylvestre@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:34212)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <sylvestre@debian.org>)
 id 1ws664-003d3P-0u; Thu, 06 Aug 2026 21:57:52 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Transfer-Encoding:Content-Type
 :Subject:From:To:MIME-Version:Date:Message-ID:Reply-To:Cc:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=/ys3wR5HG1J95sJmTXC8txSDdReRR0OhiFpljIRLnjQ=; b=NP4iO3Cf8ORbZMkNcbBk707RUS
 AEHLlFLe8bbjwDkq8wDuSRzIVpen72lZoxitkN0W3V0jV6LsMRDYKifJJ7pIG5D8LwG4uHzyq4Epk
 D5+I3Dve+Mbs5rADLtZ63nVILJs01j5+aUeLnLPFfA/UIKFwV6CeF2dYfk42KpTv4PjBniagOirFl
 SigKVfcdtMDv8jFtKUAT3j7dQwhhywPPjY4hcpt+0wt5MDwfmt069/7wMXLi5rQkGna0WiWCggzux
 ceowVawaA2SM9OA7u0YJeLTU8sORptozOEqJxz4DskUF0UEXg4YZdUWfrk4BbbpttFgZGwh/H/EfS
 f/xCBFaQ==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128)
 (Exim 4.96) (envelope-from <sylvestre@debian.org>)
 id 1ws661-00F4ZT-2f; Thu, 06 Aug 2026 21:57:50 +0000
Message-ID: <c55e48d6-963b-4bb6-8ec9-b2039e513110@debian.org>
Date: Thu, 6 Aug 2026 23:57:47 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird Beta
Content-Language: fr
To: 1135993-done@bugs.debian.org, 1135994-done@bugs.debian.org,
 1136042-done@bugs.debian.org, 1136044-done@bugs.debian.org,
 1136202-done@bugs.debian.org, 1136203-done@bugs.debian.org,
 1136207-done@bugs.debian.org
From: Sylvestre Ledru <sylvestre@debian.org>
Subject: rust-coreutils: CVE fixes landed
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Debian-User: sylvestre
X-CrossAssassin-Score: 3

Version: 0.10.0-1

These CVEs are all fixed in the upstream 0.10.0 release, which was
uploaded to unstable as rust-coreutils 0.10.0-1:

#1135993 CVE-2026-35344 dd: propagate truncate errors on regular files
#1135994 CVE-2026-35345 tail: treat a watched file replaced by a symlink 
as untailable
#1136042 CVE-2026-35352 mkfifo: drop path-based chmod, closing the 
TOCTOU race
#1136044 CVE-2026-35360 touch: create without O_TRUNC so a raced open no 
longer truncates
#1136202 CVE-2026-35374 split: harden output open path against TOCTOU 
target swaps
#1136203 CVE-2026-35376 chcon: anchor recursive relabel resolution to 
the traversal dirfd
#1136207 CVE-2026-35377 env: keep backslashes literal in single quotes, 
matching GNU

Cheers
Sylvestre]