On Friday, July 3, 2026 at 3:53 PM, Yoann Congal wrote: > On Fri Jul 3, 2026 at 3:46 PM CEST, Benjamin Robin wrote: > > Hello Yoann, > > > > On Friday, July 3, 2026 at 3:33 PM, Yoann Congal wrote: > >> On Fri Jul 3, 2026 at 3:25 PM CEST, Benjamin Robin via > >> lists.openembedded.org wrote: > >> > --- > >> > .../glib-2.0/glib-2.0/CVE-2026-58016-1.patch | 92 > >> > +++++++++++++++++++++ > >> > .../glib-2.0/glib-2.0/CVE-2026-58016-2.patch | 96 > >> > ++++++++++++++++++++++ > >> > meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 + > >> > >> NVD tells this is fixed in 2.88.1 but wrynose is at 2.88.0. Can you send > >> a patch for wrynose so I can accept this on scarthgap? > > > > The fun thing, that this is not fixed in version 2.88.1 but in 2.89.0. > > Then, > * NVD is wrong(?). Can you send a modification request so we avoid false > negatives (those are the worst ones!)
Yes, this was in my (very) long TODO list. The commit fixing this issue is [1] and it was never backported. The version 2.88.2 does not have the fix. I am going to to that now :) > * And, in that case, master is also impacted and need a fix. I have sent: - A patch for master upgrading to 2.89.1 - A patch for wrynose with the patches applied on 2.88.0 [1] https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2 -- Benjamin Robin, Bootlin Embedded Linux and Kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240117): https://lists.openembedded.org/g/openembedded-core/message/240117 Mute This Topic: https://lists.openembedded.org/mt/120099359/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
