[meta-oe,kirkstone,14/16] tigervnc: ignore CVE-2023-6478

Message ID	20260209113904.3442496-14-skandigraun@gmail.com
State	New
Headers	show Return-Path: <skandigraun@gmail.com> ip: 209.85.128.49, mailfrom: skandigraun@gmail.com) From: Gyorgy Sarvari <skandigraun@gmail.com> To: openembedded-devel@lists.openembedded.org Subject: [meta-oe][kirkstone][PATCH 14/16] tigervnc: ignore CVE-2023-6478 Date: Mon, 9 Feb 2026 12:39:01 +0100 Message-ID: <20260209113904.3442496-14-skandigraun@gmail.com> In-Reply-To: <20260209113904.3442496-1-skandigraun@gmail.com> References: <20260209113904.3442496-1-skandigraun@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 \| expand [meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 [meta-multimedia,kirkstone,02/16] sox: patch CVE-2017-11358 [meta-multimedia,kirkstone,03/16] sox: patch CVE-2017-11359 [meta-multimedia,kirkstone,04/16] sox: patch CVE-2017-15370 [meta-multimedia,kirkstone,05/16] sox: patch CVE-2017-15371 [meta-multimedia,kirkstone,06/16] sox: patch CVE-2017-15372 [meta-multimedia,kirkstone,07/16] sox: patch CVE-2017-15642 [meta-multimedia,kirkstone,08/16] sox: patch CVE-2017-18189 [meta-multimedia,kirkstone,09/16] sox: mark CVE-2019-1010004 as patched [meta-multimedia,kirkstone,10/16] sox: patch CVE-2019-13590 [meta-multimedia,kirkstone,11/16] sox: patch CVE-2019-8354 [meta-oe,kirkstone,12/16] tigervnc: sync xserver component with oe-core [meta-oe,kirkstone,13/16] tigervnc: ignore CVE-2023-6377 [meta-oe,kirkstone,14/16] tigervnc: ignore CVE-2023-6478 [meta-oe,kirkstone,15/16] tigervnc: ignore CVE-2025-26594...26601 [meta-oe,kirkstone,16/16] tigervnc: mark CVE-2024-0408 and CVE-2024-0409 patched

Message ID

20260209113904.3442496-14-skandigraun@gmail.com

State

New

Headers

From: Gyorgy Sarvari <skandigraun@gmail.com>
To: openembedded-devel@lists.openembedded.org
Subject: [meta-oe][kirkstone][PATCH 14/16] tigervnc: ignore CVE-2023-6478
Date: Mon,  9 Feb 2026 12:39:01 +0100
Message-ID: <20260209113904.3442496-14-skandigraun@gmail.com>
In-Reply-To: <20260209113904.3442496-1-skandigraun@gmail.com>
References: <20260209113904.3442496-1-skandigraun@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[meta-multimedia,kirkstone,01/16] sox: patch CVE-2017-11332 | expand

Commit Message

Gyorgy Sarvari Feb. 9, 2026, 11:39 a.m. UTC

Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6478

TigerVNC compiles its own xserver, this is why this CVE is associated
with it - despite the vulnerability being in xserver.

The vulnerability was fixed by [1] (from the nvd report), which has been
backported[2] to the xserver version used by the recipe - so ignore the
CVE, since it's patched already.

[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/58e83c683950ac9e253ab05dd7a13a8368b70a3c

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 62a78f8ba7c8bd229cc82cf81bcc6a6d8116ebca)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
index 9e4d05186f..4f9b9f7267 100644
--- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
+++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
@@ -123,4 +123,4 @@  FILES:${PN}-dbg += "${libdir}/xorg/modules/extensions/.debug"
 CVE_CHECK_IGNORE += "CVE-2014-8241"
 
 # fixed-version: The vulnerable code is not present in the used xserver version (21.1.18)
-CVE_CHECK_IGNORE += "CVE-2023-6377"
+CVE_CHECK_IGNORE += "CVE-2023-6377 CVE-2023-6478"

[meta-oe,kirkstone,14/16] tigervnc: ignore CVE-2023-6478

Commit Message

Patch