Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details

From: Romain Naour via buildroot <buildroot@buildroot.org>
To: Thomas Perale <thomas.perale@mind.be>, buildroot@buildroot.org
Cc: Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Subject: Re: [Buildroot] [RFC PATCH 11/14] package/glibc: add vulnerability details
Date: Wed, 24 Jun 2026 16:45:43 +0200	[thread overview]
Message-ID: <20bfb43a-815e-4d72-ae98-68e51549ea89@smile.fr> (raw)
In-Reply-To: <20260624140645.185318-12-thomas.perale@mind.be>

Hello Thomas, All,

Le 24/06/2026 à 16:06, Thomas Perale via buildroot a écrit :
> Those vulnerabilities has already been addressed upstream but no new
> package version have been released with those fixes.
> 
> The CVE-2010-4756 is not considered as a security issue by the upstream
> project and is then marked as fixed.
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> ---
>  package/glibc/glibc.mk | 32 ++++++++++++++++++++------------
>  1 file changed, 20 insertions(+), 12 deletions(-)
> 
> diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
> index 4a6bc94634..9edab5e4d2 100644
> --- a/package/glibc/glibc.mk
> +++ b/package/glibc/glibc.mk
> @@ -19,37 +19,45 @@ GLIBC_CPE_ID_VENDOR = gnu
>  # allow proper matching with the CPE database.
>  GLIBC_CPE_ID_VERSION = $(word 1, $(subst -,$(space),$(GLIBC_VERSION)))
>  
> -# Fixed by glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65
>  GLIBC_IGNORE_CVES += CVE-2025-8058
> +GLIBC_CVE-2026-8058_STATUS = fixed
> +GLIBC_CVE-2026-8058_DETAIL = glibc-2.41-64-g1e16d0096d80a6e12d5bfa8e0aafdd13c47efd65

While updating my mailbox, I noticed this typo: CVE-2025-8058 vs CVE-2026-8058

Maybe checkpackage could check for this?

Best regards,
Romain

>  
> -# Fixed by glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
>  GLIBC_IGNORE_CVES += CVE-2026-0861
> +GLIBC_CVE-2026-0861_STATUS = fixed
> +GLIBC_CVE-2026-0861_DETAIL = glibc-2.42-49-gb0ec8fb689df862171f0f78994a3bdeb51313545
>  
> -# Fixed by glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
>  GLIBC_IGNORE_CVES += CVE-2026-0915
> +GLIBC_CVE-2026-0915_STATUS = fixed
> +GLIBC_CVE-2026-0915_DETAIL = glibc-2.42-50-g453e6b8dbab935257eb0802b0c97bca6b67ba30e
>  
> -# Fixed by glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
>  GLIBC_IGNORE_CVES += CVE-2025-15281
> +GLIBC_CVE-2025-15281_STATUS = fixed
> +GLIBC_CVE-2025-15281_DETAIL = glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125
>  
> -# Fixed by glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
>  GLIBC_IGNORE_CVES += CVE-2026-4437
> +GLIBC_CVE-2026-4437_STATUS = fixed
> +GLIBC_CVE-2026-4437_DETAIL = glibc-2.43-16-g5c6fca0c62ce5bd6e68e259f138097756cbafd4d
>  
> -# Fixed by glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
>  GLIBC_IGNORE_CVES += CVE-2026-4438
> +GLIBC_CVE-2026-4438_STATUS = fixed
> +GLIBC_CVE-2026-4438_DETAIL = glibc-2.43-17-gdd9945c0ba40d2dbc9eb7c99291ba6b69bd66718
>  
> -# Fixed by glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
>  GLIBC_IGNORE_CVES += CVE-2026-4046
> +GLIBC_CVE-2026-4046_STATUS = fixed
> +GLIBC_CVE-2026-4046_DETAIL = glibc-2.43-22-g8362e8ce10b24068bacc19552c128dd10e082fd9
>  
> -# Fixed by glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
>  GLIBC_IGNORE_CVES += CVE-2026-5928
> +GLIBC_CVE-2026-5928_STATUS = fixed
> +GLIBC_CVE-2026-5928_DETAIL = glibc-2.43-26-g2890b35cd361df2517525bf2c5f8c63f6f0d4a20
>  
> -# Fixed by glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
>  GLIBC_IGNORE_CVES += CVE-2026-5450
> +GLIBC_CVE-2026-5450_STATUS = fixed
> +GLIBC_CVE-2026-5450_DETAIL = glibc-2.43-27-g4070d808bea1c077eb7e7d52b52b91cae98205d5
>  
> -# This CVE is considered as not being security issues by
> -# upstream glibc:
> -#  https://security-tracker.debian.org/tracker/CVE-2010-4756
>  GLIBC_IGNORE_CVES += CVE-2010-4756
> +GLIBC_CVE-2010-4756_STATUS = fixed
> +GLIBC_CVE-2010-4756_DETAIL = This CVE is considered as not being security issues by upstream glibc: https://security-tracker.debian.org/tracker/CVE-2010-4756
>  
>  # glibc is part of the toolchain so disable the toolchain dependency
>  GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot