[Git][security-tracker-team/security-tracker][master] Track some fixes for rust-coreutils via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Aug 7 05:00:31 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d341dbb4 by Salvatore Bonaccorso at 2026-08-07T05:59:46+02:00
Track some fixes for rust-coreutils via unstable
At least one CVE is possibly not yet fixed, left untouched and asked
back to the maintainer.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -80384,15 +80384,18 @@ CVE-2026-35378 (A logic error in the expr utility of uutils coreutils causes the
NOTE: https://github.com/uutils/coreutils/pull/11395
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/76b2f7877f558f3bfa78e3d4f49f022460f509b7 (0.8.0)
CVE-2026-35377 (A logic error in the env utility of uutils coreutils causes a failure ...)
- - rust-coreutils <unfixed> (bug #1136207)
+ - rust-coreutils 0.10.0-1 (bug #1136207)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11512
+ NOTE: https://github.com/uutils/coreutils/pull/12657
CVE-2026-35376 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the ch ...)
- - rust-coreutils <unfixed> (bug #1136203)
+ - rust-coreutils 0.10.0-1 (bug #1136203)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11402
+ NOTE: https://github.com/uutils/coreutils/pull/12566
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/7cfc74e47ffab452663be6842d788a5164d9688b (0.10.0)
CVE-2026-35375 (A logic error in the split utility of uutils coreutils causes the corr ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80400,15 +80403,18 @@ CVE-2026-35375 (A logic error in the split utility of uutils coreutils causes th
NOTE: https://github.com/uutils/coreutils/pull/11397
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/d2b9550fe821a9a10bf0cec057509211357363f1 (0.8.0)
CVE-2026-35374 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the sp ...)
- - rust-coreutils <unfixed> (bug #1136202)
+ - rust-coreutils 0.10.0-1 (bug #1136202)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11401
+ NOTE: https://github.com/uutils/coreutils/pull/12565
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/58040feb5c66fce588a7ffac299b3a23bd55cd81 (0.10.0)
CVE-2026-35373 (A logic error in the ln utility of uutils coreutils causes the program ...)
- - rust-coreutils <unfixed> (bug #1136201)
+ - rust-coreutils 0.10.0-1 (bug #1136201)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/pull/11403
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/48d030dfb2ca7659ee2735f09cda706c8245a3fc (0.10.0)
CVE-2026-35372 (A logic error in the ln utility of uutils coreutils allows the utility ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80484,10 +80490,11 @@ CVE-2026-35361 (The mknod utility in uutils coreutils fails to handle security l
NOTE: https://github.com/uutils/coreutils/pull/10582
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/42b2ad83cdcf6e959ecb378c5040c60d9c64becf (0.6.0)
CVE-2026-35360 (The touch utility in uutils coreutils is vulnerable to a Time-of-Check ...)
- - rust-coreutils <unfixed> (bug #1136044)
+ - rust-coreutils 0.10.0-1 (bug #1136044)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10019
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/ca0c842e71a9f75b31c87f701952f9e174a320ce (0.10.0)
CVE-2026-35359 (A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utilit ...)
- rust-coreutils 0.8.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80530,10 +80537,11 @@ CVE-2026-35353 (The mkdir utility in uutils coreutils incorrectly applies permis
NOTE: https://github.com/uutils/coreutils/pull/10036
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/037b9583bc03d814e8516df54ebcda6f681fe1f8 (0.6.0)
CVE-2026-35352 (A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the m ...)
- - rust-coreutils <unfixed> (bug #1136042)
+ - rust-coreutils 0.10.0-1 (bug #1136042)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10020
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/c004672c5eb2415b03f11f766583c4b967ba024f (0.10.0)
CVE-2026-35351 (The mv utility in uutils coreutils fails to preserve file ownership du ...)
- rust-coreutils 0.9.0-1 (bug #1136041)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80553,10 +80561,11 @@ CVE-2026-35349 (A vulnerability in the rm utility of uutils coreutils allows a b
NOTE: https://github.com/uutils/coreutils/pull/9706
NOTE: Fixed by: https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e (0.7.0)
CVE-2026-35348 (The sort utility in uutils coreutils is vulnerable to a process panic ...)
- - rust-coreutils <unfixed> (bug #1135996)
+ - rust-coreutils 0.10.0-1 (bug #1135996)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/9696
+ NOTE: https://github.com/uutils/coreutils/pull/11593
CVE-2026-35347 (The comm utility in uutils coreutils incorrectly consumes data from no ...)
- rust-coreutils 0.6.0-1
[trixie] - rust-coreutils <no-dsa> (Minor issue)
@@ -80576,10 +80585,11 @@ CVE-2026-35345 (A vulnerability in the tail utility of uutils coreutils allows f
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/10328
CVE-2026-35344 (The dd utility in uutils coreutils suppresses errors during file trunc ...)
- - rust-coreutils <unfixed> (bug #1135993)
+ - rust-coreutils 0.10.0-1 (bug #1135993)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
[bookworm] - rust-coreutils <no-dsa> (Minor issue)
NOTE: https://github.com/uutils/coreutils/issues/9745
+ NOTE: Fixed by: https://github.com/uutils/coreutils/commit/0f538b942a5cdaba6e0960f6952429a1baaedf93 (0.10.0)
CVE-2026-35343 (The cut utility in uutils coreutils incorrectly handles the -s (only-d ...)
- rust-coreutils 0.7.0-1 (bug #1134876)
[trixie] - rust-coreutils <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d341dbb449689029a764b4d868e9f616d0a3e156
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d341dbb449689029a764b4d868e9f616d0a3e156
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260807/2caa799c/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list