[Git][security-tracker-team/security-tracker][master] Add CVE-2026-40034/rust-gix-submodule

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0c87c2b5 by Salvatore Bonaccorso at 2026-07-06T20:58:11+02:00
Add CVE-2026-40034/rust-gix-submodule

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -31228,7 +31228,9 @@ CVE-2026-40384 (An improper validation of the search parameter of the com_media
 CVE-2026-40383 (An improper validation of user-supplied input leads to a local file in ...)
 	NOT-FOR-US: Joomla
 CVE-2026-40034 (gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0 ...)
-	TODO: check
+	- rust-gix-submodule <unfixed>
+	NOTE: https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-f26g-jm89-4g65
+	NOTE: Introduced with: https://github.com/GitoxideLabs/gitoxide/commit/6a2e6a436f76c8bbf2487f9967413a51356667a0
 CVE-2026-40033 (FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in ...)
 	- freerdp3 3.26.0+dfsg-1
 	[trixie] - freerdp3 <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0c87c2b56383f5f2c9f75ecd069a426142b76fc2

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0c87c2b56383f5f2c9f75ecd069a426142b76fc2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260706/bf8b4fa4/attachment.htm>