[scarthgap,04/18] gstreamer1.0: ignore CVE-2025-2759

Message ID	7937625a30f6046ba483a000497b15169659f5eb.1760064493.git.steve@sakoman.com
State	Accepted
Delegated to:	Steve Sakoman
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.180, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 04/18] gstreamer1.0: ignore CVE-2025-2759 Date: Thu, 9 Oct 2025 19:50:23 -0700 Message-ID: <7937625a30f6046ba483a000497b15169659f5eb.1760064493.git.steve@sakoman.com> In-Reply-To: <cover.1760064493.git.steve@sakoman.com> References: <cover.1760064493.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/18] busybox: patch CVE-2025-46394 \| expand [scarthgap,01/18] busybox: patch CVE-2025-46394 [scarthgap,02/18] grub2: mark CVE-2024-2312 as not applicable [scarthgap,03/18] gstreamer1.0: ignore CVEs fixed in plugins [scarthgap,04/18] gstreamer1.0: ignore CVE-2025-2759 [scarthgap,05/18] ghostscript: patch CVE-2025-59798 [scarthgap,06/18] ghostscript: patch CVE-2025-59799 [scarthgap,07/18] ghostscript: patch CVE-2025-59800 [scarthgap,08/18] expat: follow-up for CVE-2024-8176 [scarthgap,09/18] pulseaudio: ignore CVE-2024-11586 [scarthgap,10/18] tiff: ignore 5 CVEs [scarthgap,11/18] ffmpeg: ignore 8 CVEs fixed in 6.1.1 and 6.1.3 releases [scarthgap,12/18] go: fix CVE-2025-47906 [scarthgap,13/18] glibc: stable 2.39 branch updates [scarthgap,14/18] scripts/install-buildtools: Update to 5.0.12 [scarthgap,15/18] openssl: upgrade 3.2.4 -> 3.2.6 [scarthgap,16/18] conf/bitbake.conf: use gnu mirror instead of main server [scarthgap,17/18] selftest/cases/meta_ide.py: use use gnu mirror instead of main server [scarthgap,18/18] oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main server

Message ID

7937625a30f6046ba483a000497b15169659f5eb.1760064493.git.steve@sakoman.com

State

Accepted

Delegated to:

Steve Sakoman

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 04/18] gstreamer1.0: ignore CVE-2025-2759
Date: Thu,  9 Oct 2025 19:50:23 -0700
Message-ID: 
 <7937625a30f6046ba483a000497b15169659f5eb.1760064493.git.steve@sakoman.com>
In-Reply-To: <cover.1760064493.git.steve@sakoman.com>
References: <cover.1760064493.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/18] busybox: patch CVE-2025-46394 | expand

Commit Message

Steve Sakoman Oct. 10, 2025, 2:50 a.m. UTC

From: Peter Marko <peter.marko@siemens.com>

Copy statement from [1] that it is problem of installers (non-Linux).
Also [2] linked in NVD says "Fixed in 1.25.1 Gstreamer Installer".
Since Yocto builds from sources into our own packages, ignore it.

[1] https://security-tracker.debian.org/tracker/CVE-2025-2759
[2] https://www.zerodayinitiative.com/advisories/ZDI-25-268/

(From OE-Core rev: 99ee1df6bde2ffd4fa2ddea44c0a9b94d9d77bae)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-multimedia/gstreamer/gstreamer1.0_1.22.12.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.22.12.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.22.12.bb
index cfc66745e3..5b0ba37977 100644
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.22.12.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.22.12.bb
@@ -96,4 +96,6 @@  CVE_STATUS_PLUGINS_GOOD = " \
 "
 CVE_STATUS_PLUGINS_GOOD[status] = "cpe-incorrect: this is patched in gstreamer1.0-plugins-good"
 
+CVE_STATUS[CVE-2025-2759] = "not-applicable-platform: affects installation packages for non Linux OSes"
+
 PTEST_BUILD_HOST_FILES = ""

[scarthgap,04/18] gstreamer1.0: ignore CVE-2025-2759

Commit Message

Patch