[meta-oe,kirkstone,13/16] tigervnc: ignore CVE-2023-6377

Message ID	20260209113904.3442496-13-skandigraun@gmail.com
State	New
Headers	show Return-Path: <skandigraun@gmail.com> ip: 209.85.128.52, mailfrom: skandigraun@gmail.com) From: Gyorgy Sarvari <skandigraun@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][kirkstone][PATCH 13/16] tigervnc: ignore CVE-2023-6377 Date: Mon, 9 Feb 2026 12:39:00 +0100 Message-ID: <20260209113904.3442496-13-skandigraun@gmail.com> In-Reply-To: <20260209113904.3442496-1-skandigraun@gmail.com> References: <20260209113904.3442496-1-skandigraun@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 \| expand [meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 [meta-multimedia,kirkstone,02/16] sox: patch CVE-2017-11358 [meta-multimedia,kirkstone,03/16] sox: patch CVE-2017-11359 [meta-multimedia,kirkstone,04/16] sox: patch CVE-2017-15370 [meta-multimedia,kirkstone,05/16] sox: patch CVE-2017-15371 [meta-multimedia,kirkstone,06/16] sox: patch CVE-2017-15372 [meta-multimedia,kirkstone,07/16] sox: patch CVE-2017-15642 [meta-multimedia,kirkstone,08/16] sox: patch CVE-2017-18189 [meta-multimedia,kirkstone,09/16] sox: mark CVE-2019-1010004 as patched [meta-multimedia,kirkstone,10/16] sox: patch CVE-2019-13590 [meta-multimedia,kirkstone,11/16] sox: patch CVE-2019-8354 [meta-oe,kirkstone,12/16] tigervnc: sync xserver component with oe-core [meta-oe,kirkstone,13/16] tigervnc: ignore CVE-2023-6377 [meta-oe,kirkstone,14/16] tigervnc: ignore CVE-2023-6478 [meta-oe,kirkstone,15/16] tigervnc: ignore CVE-2025-26594...26601 [meta-oe,kirkstone,16/16] tigervnc: mark CVE-2024-0408 and CVE-2024-0409 patched

Message ID

20260209113904.3442496-13-skandigraun@gmail.com

State

New

Headers

From: Gyorgy Sarvari <skandigraun@gmail.com>
To: openembedded-devel@lists.openembedded.org
Subject: [meta-oe][kirkstone][PATCH 13/16] tigervnc: ignore CVE-2023-6377
Date: Mon,  9 Feb 2026 12:39:00 +0100
Message-ID: <20260209113904.3442496-13-skandigraun@gmail.com>
In-Reply-To: <20260209113904.3442496-1-skandigraun@gmail.com>
References: <20260209113904.3442496-1-skandigraun@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 | expand

Commit Message

Gyorgy Sarvari Feb. 9, 2026, 11:39 a.m. UTC

Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6377

TigerVNC compiles its own xserver, this is why this CVE is associated
with it - despite the vulnerability being in xserver.

The vulnerability was fixed by [1] (from the nvd report), which has been
backported[2] to the xserver version used by the recipe - so ignore the
CVE, since it's patched already.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a7bda3080d2b44eae668cdcec7a93095385b9652

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f691f2178b15eec22f09a1c17b9945fad4e330e6)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
index f995c1ef08..9e4d05186f 100644
--- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
+++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
@@ -121,3 +121,6 @@  FILES:${PN}-dbg += "${libdir}/xorg/modules/extensions/.debug"
 
 # fixed-version: The vulnerable code is not present in the used version (1.11.0)
 CVE_CHECK_IGNORE += "CVE-2014-8241"
+
+# fixed-version: The vulnerable code is not present in the used xserver version (21.1.18)
+CVE_CHECK_IGNORE += "CVE-2023-6377"

[meta-oe,kirkstone,13/16] tigervnc: ignore CVE-2023-6377

Commit Message

Patch