[scarthgap,03/10] xz: ignore CVE-2024-47611

Message ID	04ce4704e603cd66f30ffc001541c6497d84050e.1755633925.git.steve@sakoman.com
State	New
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.173, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 03/10] xz: ignore CVE-2024-47611 Date: Tue, 19 Aug 2025 13:07:46 -0700 Message-ID: <04ce4704e603cd66f30ffc001541c6497d84050e.1755633925.git.steve@sakoman.com> In-Reply-To: <cover.1755633925.git.steve@sakoman.com> References: <cover.1755633925.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/10] cve-check: Add missing call to exit_if_errors \| expand [scarthgap,01/10] cve-check: Add missing call to exit_if_errors [scarthgap,02/10] dropbear: patch CVE-2025-47203 [scarthgap,03/10] xz: ignore CVE-2024-47611 [scarthgap,04/10] glib-2.0: ignore CVE-2025-4056 [scarthgap,05/10] libxml2: ignore CVE-2025-8732 [scarthgap,06/10] e2fsprogs: Fix build failure with gcc 15 [scarthgap,07/10] parted: Fix build with GCC 15 [scarthgap,08/10] cairo: fix build with gcc-15 on host [scarthgap,09/10] bash: Stick to C17 std [scarthgap,10/10] bash: use -std=gnu17 also for native CFLAGS

Message ID

04ce4704e603cd66f30ffc001541c6497d84050e.1755633925.git.steve@sakoman.com

State

New

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 03/10] xz: ignore CVE-2024-47611
Date: Tue, 19 Aug 2025 13:07:46 -0700
Message-ID: 
 <04ce4704e603cd66f30ffc001541c6497d84050e.1755633925.git.steve@sakoman.com>
In-Reply-To: <cover.1755633925.git.steve@sakoman.com>
References: <cover.1755633925.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/10] cve-check: Add missing call to exit_if_errors | expand

Commit Message

Steve Sakoman Aug. 19, 2025, 8:07 p.m. UTC

From: Daniel Turull <daniel.turull@ericsson.com>

According to the NVD entry, it is only applicable when built
for native Windows (MinGW-w64 or MSVC).

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/xz/xz_5.4.7.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-extended/xz/xz_5.4.7.bb b/meta/recipes-extended/xz/xz_5.4.7.bb
index 563643d4d9..30a4c8e88c 100644
--- a/meta/recipes-extended/xz/xz_5.4.7.bb
+++ b/meta/recipes-extended/xz/xz_5.4.7.bb
@@ -35,6 +35,8 @@  SRC_URI[sha256sum] = "8db6664c48ca07908b92baedcfe7f3ba23f49ef2476864518ab5db6723
 UPSTREAM_CHECK_REGEX = "releases/tag/v(?P<pver>\d+(\.\d+)+)"
 UPSTREAM_CHECK_URI = "https://github.com/tukaani-project/xz/releases/"
 
+CVE_STATUS[CVE-2024-47611] = "not-applicable-platform: Issue only applies on Windows"
+
 CACHED_CONFIGUREVARS += "gl_cv_posix_shell=/bin/sh"
 
 inherit autotools gettext ptest

[scarthgap,03/10] xz: ignore CVE-2024-47611

Commit Message

Patch