From: Peter Marko <peter.marko@siemens.com>
To: openembedded-core@lists.openembedded.org
Cc: Peter Marko <peter.marko@siemens.com>
Subject: [PATCH] xserver-xorg: set status for CVE-2026-55999 and CVE-2026-56000
Date: Sun, 2 Aug 2026 23:34:13 +0200 [thread overview]
Message-ID: <20260802213413.2425121-1-peter.marko@siemens.com> (raw)
From: Peter Marko <peter.marko@siemens.com>
Per [1], CVE-2026-55999 was fixed by [2] which was backported as [3].
Per [4], CVE-2026-56000 was fixed by [5] which was backported as [6].
[1] https://security-tracker.debian.org/tracker/CVE-2026-55999
[2] https://gitlab.freedesktop.org/xorg/xserver/-/commit/fbf7bac22e2c6bd627fb042742a23318263edae1
[3] https://gitlab.freedesktop.org/xorg/xserver/-/commit/0f1f4bcbfb1f23b800dfe386782d3a0f05b6756f
[4] https://security-tracker.debian.org/tracker/CVE-2026-56000
[5] https://gitlab.freedesktop.org/xorg/xserver/-/commit/2779affbdb4354e894f490e56f962527d6125043
[6] https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6d96084f305a142eb3db7f720d7edd21e4c98b4
cvelistV5 has correct version identification, so CNA (SUSE) has it
correct, too.
NVD however shows non-existing version 21.2.24 (probably from CVE
description), so it's showing up in reports as unfixed.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
meta/recipes-graphics/xorg-xserver/xserver-xorg.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
index 7c0a24e58b..689758fd6b 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg.inc
@@ -31,6 +31,8 @@ available for this flaw."
CVE_STATUS[CVE-2022-3553] = "cpe-incorrect: This is specific to XQuartz, which is the macOS X server port"
CVE_STATUS[CVE-2026-34000] = "fixed-version: fixed since v21.1.22"
CVE_STATUS[CVE-2026-34002] = "fixed-version: fixed since v21.1.22"
+CVE_STATUS[CVE-2026-55999] = "fixed-version: fixed since v21.1.24"
+CVE_STATUS[CVE-2026-56000] = "fixed-version: fixed since v21.1.24"
S = "${UNPACKDIR}/${XORG_PN}-${PV}"
reply other threads:[~2026-08-02 21:34 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260802213413.2425121-1-peter.marko@siemens.com \
--to=peter.marko@siemens.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox