[Git][security-tracker-team/security-tracker][master] CVE-2026-34085/fontconfig: bullseye not-affected

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e8ec66e2 by Sylvain Beucler at 2026-03-27T09:26:46+01:00
CVE-2026-34085/fontconfig: bullseye not-affected

trixie/bookworm probably neither

Cf. discussion at archlinux:
https://gitlab.archlinux.org/archlinux/packaging/packages/fontconfig/-/work_items/3#note_281566

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -687,8 +687,10 @@ CVE-2026-3126
 	REJECTED
 CVE-2026-34085 (fontconfig before 2.17.1 has an off-by-one error in allocation during  ...)
 	- fontconfig 2.17.1-3
+	[bullseye] - fontconfig <not-affected> (Vulnerable code introduced later)
 	NOTE: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481
 	NOTE: Fixed by: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc (2.17.1)
+	NOTE: Introduced by: https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/bf3fbad0ffa955a63bc7b515da002d363cf4d5fc (2.17.0)
 CVE-2026-33809 (A maliciously crafted TIFF file can cause image decoding to attempt to ...)
 	TODO: check
 CVE-2026-33751 (n8n is an open source workflow automation platform. Prior to versions  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8ec66e2b333e2365ceaaf80adb0578a72bcbe50

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8ec66e2b333e2365ceaaf80adb0578a72bcbe50
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260327/c6462b91/attachment.htm>