| Message ID | 20260402091620.341851-1-adarsh.jagadish.kamini@est.tech |
|---|---|
| State | New |
| Headers | show |
| Series | [master] binutils: mark CVE-2025-69650 and CVE-2025-69651 as disputed | expand |
Hi Adarsh, Could you please also send this for kirkstone? The same patch is required there as well. On 02-04-2026 02:46 pm, Adarsh Jagadish Kamini via lists.openembedded.org wrote: > CAUTION: This email comes from a non Wind River email account! > Do not click links or open attachments unless you recognize the sender and know the content is safe. > > From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> > > Both CVEs are disputed by third parties. The observed behavior > (double free / invalid pointer free in readelf) only occurred in > pre-release code and did not affect any tagged version [1][2]. > > CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" > CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" > > [1] https://www.cve.org/CVERecord?id=CVE-2025-69650 > [2] https://www.cve.org/CVERecord?id=CVE-2025-69651 > > Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> > --- > meta/recipes-devtools/binutils/binutils-2.46.inc | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc > index ff10050dd9..cd2867c421 100644 > --- a/meta/recipes-devtools/binutils/binutils-2.46.inc > +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc > @@ -18,6 +18,9 @@ SRCBRANCH ?= "binutils-2_46-branch" > > UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)" > > +CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" > +CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" > + > SRCREV ?= "49d4d3fafa4ec4ff5a3460d91d5b1ed5286487db" > BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" > SRC_URI = "\ > -- > 2.34.1 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#234509): https://lists.openembedded.org/g/openembedded-core/message/234509 > Mute This Topic: https://lists.openembedded.org/mt/118630447/10244482 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Hemanth.KumarMD@windriver.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc index ff10050dd9..cd2867c421 100644 --- a/meta/recipes-devtools/binutils/binutils-2.46.inc +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc @@ -18,6 +18,9 @@ SRCBRANCH ?= "binutils-2_46-branch" UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)" +CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" +CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" + SRCREV ?= "49d4d3fafa4ec4ff5a3460d91d5b1ed5286487db" BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" SRC_URI = "\