diff mbox series

[wrynose,16/60] xserver-xorg: set status for CVE-2026-55999 and CVE-2026-56000

Message ID 3ac73f299c2f78d9a37f20951917d7ee0f036930.1791707817.git.yoann.congal@smile.fr
State New
Headers show
Series [wrynose,01/60] glibc: set status for CVE-2011-0536 and CVE-2025-0577 | expand

Commit Message

Yoann Congal Oct. 11, 2026, 8:39 a.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Per [1], CVE-2026-55999 was fixed by [2] which was backported as [3].
Per [4], CVE-2026-56000 was fixed by [5] which was backported as [6].

[1] https://security-tracker.debian.org/tracker/CVE-2026-55999
[2] https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1
[3] https://gitlab.freedesktop.org/xorg/xserver/-/commit/0f1f4bcbfb1f23b800dfe386782d3a0f05b6756f
[4] https://security-tracker.debian.org/tracker/CVE-2026-56000
[5] https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
[6] https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6d96084f305a142eb3db7f720d7edd21e4c98b4

cvelistV5 has correct version identification, so CNA (SUSE) has it
correct, too.
NVD however shows non-existing version 21.2.24 (probably from CVE
description), so it's showing up in reports as unfixed.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: b6ab21c7e75acb65a3993565929be9c72f4a3d39)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
index 782c1f76ca4..419e539a541 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
@@ -31,6 +31,8 @@  available for this flaw."
 CVE_STATUS[CVE-2022-3553] = "cpe-incorrect: This is specific to XQuartz, which is the macOS X server port"
 CVE_STATUS[CVE-2026-34000] = "fixed-version: fixed since v21.1.22"
 CVE_STATUS[CVE-2026-34002] = "fixed-version: fixed since v21.1.22"
+CVE_STATUS[CVE-2026-55999] = "fixed-version: fixed since v21.1.24"
+CVE_STATUS[CVE-2026-56000] = "fixed-version: fixed since v21.1.24"
 
 S = "${UNPACKDIR}/${XORG_PN}-${PV}"