From f44ee51eb986bf11d5f4d73f4a1af1ae631e1896 Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Thu, 26 Jun 2025 10:30:05 +0200 Subject: [PATCH] package/libmpeg2: add CPE_ID_VENDOR At the moment, package stats indicates that libmpeg2 is affected by https://nvd.nist.gov/vuln/detail/CVE-2022-37416 However, this CVE applies to a completely different piece of software, that has the same name "libmpeg2" [1]. To avoid the confusion, let's add a proper CPE vendor to Buildroot's libmpeg2. The library itself does not clearly identify any vendor name, and there isn't any existing CPE on the NVD website. Since this library is not updated for many years (maybe even before the introduction of the CPE system), but the code is somehow related to the Videolan project, let's add this as the vendor, which sould solve the matched CVE issue. [1] https://github.com/ittiam-systems/libmpeg2 Signed-off-by: Titouan Christophe [Julien: fix typo in commit title] Signed-off-by: Julien Olivain (cherry picked from commit 585ee147dd125b617f036acbb3e9668c30dab47b) Signed-off-by: Thomas Perale --- package/libmpeg2/libmpeg2.mk | 2 ++ 1 file changed, 2 insertions(+) diff --git a/package/libmpeg2/libmpeg2.mk b/package/libmpeg2/libmpeg2.mk index cab800162c..ec23dff57b 100644 --- a/package/libmpeg2/libmpeg2.mk +++ b/package/libmpeg2/libmpeg2.mk @@ -16,6 +16,8 @@ LIBMPEG2_INSTALL_STAGING = YES LIBMPEG2_AUTORECONF = YES LIBMPEG2_CONF_OPTS = --without-x --disable-directx +LIBMPEG2_CPE_ID_VENDOR = videolan + ifeq ($(BR2_PACKAGE_SDL),y) LIBMPEG2_CONF_ENV += ac_cv_prog_SDLCONFIG=$(STAGING_DIR)/usr/bin/sdl-config LIBMPEG2_CONF_OPTS += --enable-sdl