From 44c0deba937fc42181caaf37a83dd9f2916117cc Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 3 Mar 2026 09:13:21 +0100 Subject: [PATCH] package/graphicsmagick: add CVE-2007-0770 to IGNORE_CVES This vulnerability match on every version of graphicsmagick [1]. It was issued because of an incomplete patch for CVE-2006-5456 and has been since remediated [2]. Since it's really old it's unlikely it will be updated and is thus added to IGNORE_CVES. [1] https://nvd.nist.gov//vuln/detail/CVE-2007-0770 [2] https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 5c03ddb28637404ab37ce3eb4a0851c8135b4251) Signed-off-by: Thomas Perale --- package/graphicsmagick/graphicsmagick.mk | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/package/graphicsmagick/graphicsmagick.mk b/package/graphicsmagick/graphicsmagick.mk index 40107b3aae..6c2885b7d8 100644 --- a/package/graphicsmagick/graphicsmagick.mk +++ b/package/graphicsmagick/graphicsmagick.mk @@ -15,6 +15,11 @@ GRAPHICSMAGICK_CPE_ID_VENDOR = graphicsmagick # Fixed in version 1.2.3 GRAPHICSMAGICK_IGNORE_CVES += CVE-2008-6621 +# Wrong NVD annotations englobbing all versions +# Wrong patch for CVE-2006-5456 later updated +# https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5 +GRAPHICSMAGICK_IGNORE_CVES += CVE-2007-0770 + # 0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27795