On Fri Jul 3, 2026 at 4:42 PM CEST, Benjamin Robin wrote: > On Friday, July 3, 2026 at 3:53 PM, Yoann Congal wrote: >> On Fri Jul 3, 2026 at 3:46 PM CEST, Benjamin Robin wrote: >> > Hello Yoann, >> > >> > On Friday, July 3, 2026 at 3:33 PM, Yoann Congal wrote: >> >> On Fri Jul 3, 2026 at 3:25 PM CEST, Benjamin Robin via >> >> lists.openembedded.org wrote: >> >> > --- >> >> > .../glib-2.0/glib-2.0/CVE-2026-58016-1.patch | 92 >> >> > +++++++++++++++++++++ >> >> > .../glib-2.0/glib-2.0/CVE-2026-58016-2.patch | 96 >> >> > ++++++++++++++++++++++ >> >> > meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 2 + >> >> >> >> NVD tells this is fixed in 2.88.1 but wrynose is at 2.88.0. Can you send >> >> a patch for wrynose so I can accept this on scarthgap? >> > >> > The fun thing, that this is not fixed in version 2.88.1 but in 2.89.0. >> >> Then, >> * NVD is wrong(?). Can you send a modification request so we avoid false >> negatives (those are the worst ones!) > > Yes, this was in my (very) long TODO list. > The commit fixing this issue is [1] and it was never backported. > The version 2.88.2 does not have the fix. > > I am going to to that now :) > >> * And, in that case, master is also impacted and need a fix. > > I have sent: > - A patch for master upgrading to 2.89.1 > - A patch for wrynose with the patches applied on 2.88.0 > > [1] > https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2
Sounds good! Thanks a lot :) -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240122): https://lists.openembedded.org/g/openembedded-core/message/240122 Mute This Topic: https://lists.openembedded.org/mt/120099359/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
