Re: [Buildroot] [PATCH 2/4] package/graphicsmagick: add CVE-2007-0770 to IGNORE_CVES

[Thomas Perale via buildroot <buildroot@buildroot.org>]

In reply of:
> This vulnerability match on every version of graphicsmagick [1].
> It was issued because of an incomplete patch for CVE-2006-5456 and has
> been since remediated [2].
> 
> Since it's really old it's unlikely it will be updated and is thus added
> to IGNORE_CVES.
> 
> [1] https://nvd.nist.gov//vuln/detail/CVE-2007-0770
> [2] https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

Applied to 2025.02.x & 2025.11.x. Thanks

> ---
>  package/graphicsmagick/graphicsmagick.mk | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/package/graphicsmagick/graphicsmagick.mk b/package/graphicsmagick/graphicsmagick.mk
> index 40107b3aae..6c2885b7d8 100644
> --- a/package/graphicsmagick/graphicsmagick.mk
> +++ b/package/graphicsmagick/graphicsmagick.mk
> @@ -15,6 +15,11 @@ GRAPHICSMAGICK_CPE_ID_VENDOR = graphicsmagick
>  # Fixed in version 1.2.3
>  GRAPHICSMAGICK_IGNORE_CVES += CVE-2008-6621
>  
> +# Wrong NVD annotations englobbing all versions
> +# Wrong patch for CVE-2006-5456 later updated
> +# https://bugzilla.redhat.com/show_bug.cgi?id=210921#c5
> +GRAPHICSMAGICK_IGNORE_CVES += CVE-2007-0770
> +
>  # 0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch
>  GRAPHICSMAGICK_IGNORE_CVES += CVE-2025-27795
>  
> -- 
> 2.53.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot