[Git][security-tracker-team/security-tracker][master] libgit2: triage some CVE entries, add a note in dla-needed.txt

[Simon Quigley (@tsimonq2)]

Simon Quigley pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e5fda4f0 by Simon Quigley at 2026-10-08T11:15:05-05:00
libgit2: triage some CVE entries, add a note in dla-needed.txt

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -87327,6 +87327,7 @@ CVE-2026-60074 (Date::Manip versions through 7.00 for Perl return corrupted date
 CVE-2026-53587 (libgit2 is a portable C implementation of the Git core methods provide ...)
 	{DSA-6453-1}
 	- libgit2 1.9.6+ds-1
+	[bookworm] - libgit2 <not-affected> (Vulnerable code introduced later; object-format capability parsing added in 1.6.1)
 	NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-pm24-4jhq-3xvm
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/affda60c10fcef16723451c0d7dc71b71dc20ad3 (v1.9.5)
 CVE-2026-53586 (libgit2 is a portable C implementation of the Git core methods provide ...)
@@ -87347,6 +87348,7 @@ CVE-2026-53584 (libgit2 is a portable C implementation of the Git core methods p
 CVE-2026-53583 (libgit2 is a portable C implementation of the Git core methods provide ...)
 	{DSA-6453-1}
 	- libgit2 1.9.6+ds-1
+	[bookworm] - libgit2 <not-affected> (Vulnerable code not built; Bookworm uses the mbedTLS backend, not OpenSSL)
 	NOTE: https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp
 	NOTE: Fixed by: https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f (v1.9.5)
 CVE-2026-62268


=====================================
data/dla-needed.txt
=====================================
@@ -346,6 +346,7 @@ libgd-securityimage-perl
 libgit2 (Simon Quigley)
   NOTE: 20260801: Added by Front-Desk (ta)
   NOTE: 20260801: not sure whether Bullseye and Bookworm are really affected, please recheck (ta)
+  NOTE: 20261008: Bookworm is indeed affected by all but two CVEs currently open (tsimonq2)
 --
 libheif
   NOTE: 20260612: Added by Front-Desk (rouca)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e5fda4f0c6a330341f8b559c26c84f0665769e22

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e5fda4f0c6a330341f8b559c26c84f0665769e22
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261008/cef632cf/attachment-0001.htm>