From 96fdae1fbf18abc2f2de0a26da2f0503ab8f26e2 Mon Sep 17 00:00:00 2001 From: Julien Olivain Date: Sun, 25 Jan 2026 12:43:10 +0100 Subject: [PATCH] package/glibc: add CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 to _IGNORE_CVES Commit [1] bumped glibc from 2.42-3-gbc13db739 to 2.42-51-gcbf39c26b to fix some CVEs, but forgot to add those CVEs to GLIBC_IGNORE_CVES. This was needed because the GLIBC_CPE_ID_VERSION used for CVE checks remains to the same value "2.42" which is marked as vulnerable to those CVEs. This commit adds those _IGNORE_CVES with the corresponding upstream commit references, to make sure they will not be reported by the "make pkg-stats" command. Fixes: - [1] [1] https://gitlab.com/buildroot.org/buildroot/-/commit/18de297a5ad3d1fc1b44f54ae69289ca10200ad5 Cc: Waldemar Brodkorb Cc: Thomas Perale Signed-off-by: Julien Olivain Signed-off-by: Thomas Petazzoni (cherry picked from commit 574aa2cfee19c7dfe505a303dd45b17a966bbdaa) [thomas: match to 2.41 branch] Signed-off-by: Thomas Perale --- package/glibc/glibc.mk | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index 3f519bfdca..d8e178edad 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -34,6 +34,15 @@ GLIBC_IGNORE_CVES += CVE-2025-5702 # Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65 GLIBC_IGNORE_CVES += CVE-2025-8058 +# Fixed by glibc-2.41-121-g1e2c1ea4307197ccece0cda574bcfebf9080894c +GLIBC_IGNORE_CVES += CVE-2026-0861 + +# Fixed by glibc-2.41-122-g15c9839a0b853f552b4ed9047841b6223f3c104d +GLIBC_IGNORE_CVES += CVE-2026-0915 + +# Fixed by glibc-2.41-123-gfb4db64a04ad6c96cd1fbb7e02eb59323b1f2ac2 +GLIBC_IGNORE_CVES += CVE-2025-15281 + # This CVE is considered as not being security issues by # upstream glibc: # https://security-tracker.debian.org/tracker/CVE-2010-4756