diff mbox series

[wrynose,13/36] libpng: set status for CVE-2026-40930

Message ID 6d16a4aac261162704f5d5974081d061fe1cf630.1785190123.git.yoann.congal@smile.fr
State New
Headers show
Series [wrynose,01/36] curl: fix CVE-2026-7168 | expand

Commit Message

Yoann Congal July 27, 2026, 10:55 p.m. UTC 
From: Peter Marko <peter.marko@siemens.com>

Per [1]:
* The vulnerable code originates from the third-party libpng-apng patch,
which adds APNG support to libpng 1.6.x.
* Upstream libpng 1.6.x (without the apng patch) is not affected.

As Yocto never included libpng-apng patch, we can ignore this CVE.

[1] https://github.com/pnggroup/libpng/security/advisories/GHSA-c4v6-gxrq-6g2x

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8a4758455a2534050ee4b5cedcfdf86da9f243c2)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-multimedia/libpng/libpng_1.6.56.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
index 9dbd0d26e06..9a85d44f52b 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
@@ -72,3 +72,5 @@  do_install_ptest() {
 }
 
 BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2026-40930] = "cpe-incorrect: Yocto never included affected libpng-apng patch"