Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details

From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: Romain Naour <romain.naour@smile.fr>
Cc: Thomas Perale <thomas.perale@mind.be>,
	buildroot@buildroot.org,
	Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Subject: Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details
Date: Wed, 24 Jun 2026 17:06:32 +0200	[thread overview]
Message-ID: <20260624150633.217471-1-thomas.perale@mind.be> (raw)
In-Reply-To: <20bfb43a-815e-4d72-ae98-68e51549ea89@smile.fr>

Hi Romain,

In reply of:
> Hello Thomas, All,
> 
> Le 24/06/2026 à 16:06, Thomas Perale via buildroot a écrit :
> > Those vulnerabilities has already been addressed upstream but no new
> > package version have been released with those fixes.
> > 
> > The CVE-2010-4756 is not considered as a security issue by the upstream
> > project and is then marked as fixed.
> > 
> > Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> > ---
> >  package/glibc/glibc.mk | 32 ++++++++++++++++++++------------
> >  1 file changed, 20 insertions(+), 12 deletions(-)
> > 
> > diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
> > index 4a6bc94634..9edab5e4d2 100644
> > --- a/package/glibc/glibc.mk
> > +++ b/package/glibc/glibc.mk
> > @@ -19,37 +19,45 @@ GLIBC_CPE_ID_VENDOR = gnu
> >  # allow proper matching with the CPE database.
> >  GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
> >  
> > -# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
> >  GLIBC_IGNORE_CVES += CVE-2025-8058
> > +GLIBC_CVE-2026-8058_STATUS = fixed
> > +GLIBC_CVE-2026-8058_DETAIL = glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
> 
> While updating my mailbox, I noticed this typo: CVE-2025-8058 vs CVE-2026-8058
> 
> Maybe checkpackage could check for this?
> 
> Best regards,
> Romain

Good catch thanks ! I will add this to the checkpackage check I added for the
"_STATUS" content.

> >  
> > -# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
> >  GLIBC_IGNORE_CVES += CVE-2026-0861
> > +GLIBC_CVE-2026-0861_STATUS = fixed
> > +GLIBC_CVE-2026-0861_DETAIL = glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
> >  
> > -# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
> >  GLIBC_IGNORE_CVES += CVE-2026-0915
> > +GLIBC_CVE-2026-0915_STATUS = fixed
> > +GLIBC_CVE-2026-0915_DETAIL = glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
> >  
> > -# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
> >  GLIBC_IGNORE_CVES += CVE-2025-15281
> > +GLIBC_CVE-2025-15281_STATUS = fixed
> > +GLIBC_CVE-2025-15281_DETAIL = glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
> >  
> > -# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
> >  GLIBC_IGNORE_CVES += CVE-2026-4437
> > +GLIBC_CVE-2026-4437_STATUS = fixed
> > +GLIBC_CVE-2026-4437_DETAIL = glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
> >  
> > -# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
> >  GLIBC_IGNORE_CVES += CVE-2026-4438
> > +GLIBC_CVE-2026-4438_STATUS = fixed
> > +GLIBC_CVE-2026-4438_DETAIL = glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
> >  
> > -# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
> >  GLIBC_IGNORE_CVES += CVE-2026-4046
> > +GLIBC_CVE-2026-4046_STATUS = fixed
> > +GLIBC_CVE-2026-4046_DETAIL = glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
> >  
> > -# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
> >  GLIBC_IGNORE_CVES += CVE-2026-5928
> > +GLIBC_CVE-2026-5928_STATUS = fixed
> > +GLIBC_CVE-2026-5928_DETAIL = glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
> >  
> > -# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
> >  GLIBC_IGNORE_CVES += CVE-2026-5450
> > +GLIBC_CVE-2026-5450_STATUS = fixed
> > +GLIBC_CVE-2026-5450_DETAIL = glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
> >  
> > -# This CVE is considered as not being security issues by
> > -# upstream glibc:
> > -#  https://security-tracker.debian.org/tracker/CVE-2010-4756
> >  GLIBC_IGNORE_CVES += CVE-2010-4756
> > +GLIBC_CVE-2010-4756_STATUS = fixed
> > +GLIBC_CVE-2010-4756_DETAIL = This CVE is considered as not being security issues by upstream glibc: https://security-tracker.debian.org/tracker/CVE-2010-4756
> >  
> >  # glibc is part of the toolchain so disable the toolchain dependency
> >  GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot