[whinlatter,8/9] tigervnc: ignore CVE-2014-8241

Message ID	20251126204847.1969339-8-ankur.tyagi85@gmail.com
State	New
Headers	show Return-Path: <ankur.tyagi85@gmail.com> ip: 209.85.214.175, mailfrom: ankur.tyagi85@gmail.com) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Gyorgy Sarvari <skandigraun@gmail.com>, Khem Raj <raj.khem@gmail.com>, Ankur Tyagi <ankur.tyagi85@gmail.com> Subject: [oe][whinlatter][PATCH 8/9] tigervnc: ignore CVE-2014-8241 Date: Thu, 27 Nov 2025 09:48:45 +1300 Message-ID: <20251126204847.1969339-8-ankur.tyagi85@gmail.com> In-Reply-To: <20251126204847.1969339-1-ankur.tyagi85@gmail.com> References: <20251126204847.1969339-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[whinlatter,1/9] exiv2: add ptest support \| expand [whinlatter,1/9] exiv2: add ptest support [whinlatter,2/9] xdebug: upgrade 3.4.6 -> 3.4.7 [whinlatter,3/9] php: upgrade 8.4.14 -> 8.4.15 [whinlatter,4/9] libao: ignore CVE-2017-11548 [whinlatter,5/9] gsoap: upgrade 2.8.135 -> 2.8.137 [whinlatter,6/9] mariadb: Upgrade 11.4.8 -> 11.4.9 [whinlatter,7/9] cockpit: set correct CVE_PRODUCT [whinlatter,8/9] tigervnc: ignore CVE-2014-8241 [whinlatter,9/9] rsyslog: upgrade 8.2506.0 -> 8.2510.0

Message ID

20251126204847.1969339-8-ankur.tyagi85@gmail.com

State

New

Headers

From: ankur.tyagi85@gmail.com
To: openembedded-devel@lists.openembedded.org
Cc: Gyorgy Sarvari <skandigraun@gmail.com>,
	Khem Raj <raj.khem@gmail.com>,
	Ankur Tyagi <ankur.tyagi85@gmail.com>
Subject: [oe][whinlatter][PATCH 8/9] tigervnc: ignore CVE-2014-8241
Date: Thu, 27 Nov 2025 09:48:45 +1300
Message-ID: <20251126204847.1969339-8-ankur.tyagi85@gmail.com>
In-Reply-To: <20251126204847.1969339-1-ankur.tyagi85@gmail.com>
References: <20251126204847.1969339-1-ankur.tyagi85@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[whinlatter,1/9] exiv2: add ptest support | expand

Commit Message

Ankur Tyagi Nov. 26, 2025, 8:48 p.m. UTC

From: Gyorgy Sarvari <skandigraun@gmail.com>

Details: https://nvd.nist.gov/vuln/detail/CVE-2014-8241

The vulnerability is about a potential null-pointer dereference, because
of a malloc result is not verified[1].

The vulnerable code has been refactored since completely[2], and the code isn't
present anymore in the codebase.

[1]: https://github.com/TigerVNC/tigervnc/issues/993#issuecomment-612874972 - attachment
[2]: https://github.com/TigerVNC/tigervnc/commit/b8a24f055f1a29886d8b18bb3f0902144dc5bd14

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ed8a1038d227ee521cf2349d9f7f8e37eec6a64a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb
index dd4f79c314..d3159f8a88 100644
--- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb
+++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb
@@ -85,3 +85,5 @@  FILES:${PN} += " \
 "
 
 SYSTEMD_SERVICE:${PN} = "vncserver@.service"
+
+CVE_STATUS[2014-8241] = "fixed-version: The vulnerable code is not present in the used version (1.15.0)"

[whinlatter,8/9] tigervnc: ignore CVE-2014-8241

Commit Message

Patch