From af208ccb898cd0eebaeb9515f685165c8adfa5cf Mon Sep 17 00:00:00 2001 From: Julien Olivain Date: Sun, 25 Jan 2026 12:43:10 +0100 Subject: [PATCH] package/glibc: add CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 to _IGNORE_CVES Commit [1] bumped glibc from 2.42-3-gbc13db739 to 2.42-51-gcbf39c26b to fix some CVEs, but forgot to add those CVEs to GLIBC_IGNORE_CVES. This was needed because the GLIBC_CPE_ID_VERSION used for CVE checks remains to the same value "2.42" which is marked as vulnerable to those CVEs. This commit adds those _IGNORE_CVES with the corresponding upstream commit references, to make sure they will not be reported by the "make pkg-stats" command. Fixes: - [1] [1] https://gitlab.com/buildroot.org/buildroot/-/commit/18de297a5ad3d1fc1b44f54ae69289ca10200ad5 Cc: Waldemar Brodkorb Cc: Thomas Perale Signed-off-by: Julien Olivain Signed-off-by: Thomas Petazzoni (cherry picked from commit 574aa2cfee19c7dfe505a303dd45b17a966bbdaa) Signed-off-by: Thomas Perale --- package/glibc/glibc.mk | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index e3453b8cc2..44bf9c4b06 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -28,6 +28,15 @@ GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION))) # Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65 GLIBC_IGNORE_CVES += CVE-2025-8058 +# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545 +GLIBC_IGNORE_CVES += CVE-2026-0861 + +# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e +GLIBC_IGNORE_CVES += CVE-2026-0915 + +# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125 +GLIBC_IGNORE_CVES += CVE-2025-15281 + # This CVE is considered as not being security issues by # upstream glibc: # https://security-tracker.debian.org/tracker/CVE-2010-4756