[kirkstone,8/9] glib-2.0: ignore CVE-2025-4056

Message ID	8c69793deb78cf9718801825477938c22e229eca.1755636489.git.steve@sakoman.com
State	New
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.214.175, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 8/9] glib-2.0: ignore CVE-2025-4056 Date: Tue, 19 Aug 2025 13:49:47 -0700 Message-ID: <8c69793deb78cf9718801825477938c22e229eca.1755636489.git.steve@sakoman.com> In-Reply-To: <cover.1755636489.git.steve@sakoman.com> References: <cover.1755636489.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[kirkstone,1/9] systemd: Fix manpage build after CVE-2025-4598 \| expand [kirkstone,1/9] systemd: Fix manpage build after CVE-2025-4598 [kirkstone,2/9] gstreamer1.0-plugins-base: fix CVE-2025-47806 & CVE-2025-47808 [kirkstone,3/9] gstreamer1.0-plugins-good: fix CVE-2025-47183 & CVE-2025-47219 [kirkstone,4/9] xserver-xorg: Fix for CVE-2025-49175 [kirkstone,5/9] xserver-xorg: Fix for CVE-2025-49176 [kirkstone,6/9] xserver-xorg: Fix for CVE-2025-49177 [kirkstone,7/9] git: fix CVE-2025-27614-CVE-2025-27613-CVE-2025-46334-CVE-2025-46835 [kirkstone,8/9] glib-2.0: ignore CVE-2025-4056 [kirkstone,9/9] libubootenv: backport patch to fix unknown type name 'size_t'

Message ID

8c69793deb78cf9718801825477938c22e229eca.1755636489.git.steve@sakoman.com

State

New

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][kirkstone 8/9] glib-2.0: ignore CVE-2025-4056
Date: Tue, 19 Aug 2025 13:49:47 -0700
Message-ID: 
 <8c69793deb78cf9718801825477938c22e229eca.1755636489.git.steve@sakoman.com>
In-Reply-To: <cover.1755636489.git.steve@sakoman.com>
References: <cover.1755636489.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[kirkstone,1/9] systemd: Fix manpage build after CVE-2025-4598 | expand

Commit Message

Steve Sakoman Aug. 19, 2025, 8:49 p.m. UTC

From: Peter Marko <peter.marko@siemens.com>

NVD report [1] says:
A flaw was found in GLib. A denial of service on **Windows platforms**
may occur if an application attempts to spawn a program using long
command lines.

The fix [3] (linked from [2]) also changes only files
glib/gspawn-win32-helper.c
glib/gspawn-win32.c

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-4056
[2] https://gitlab.gnome.org/GNOME/glib/-/issues/3668
[3] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4570

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb
index 8d2c452088..31b6c1fe98 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb
+++ b/meta/recipes-core/glib-2.0/glib-2.0_2.72.3.bb
@@ -97,3 +97,6 @@  def find_meson_cross_files(d):
 python () {
     find_meson_cross_files(d)
 }
+
+# not-applicable-platform: Issue only applies on Windows
+CVE_CHECK_IGNORE += "CVE-2025-4056"

[kirkstone,8/9] glib-2.0: ignore CVE-2025-4056

Commit Message

Patch