Re: [OE-core][PATCH 0/2] coreutils: fix multiple CVEs

[Richard Purdie <richard.purdie@linuxfoundation.org>]

On Sat, 2026-08-01 at 00:02 -0700, Collin Funk wrote:
> Richard Purdie <richard.purdie@linuxfoundation.org> writes:
> 
> > Sadly, I suspect this is becoming all the more common and I share your
> > frustrations.
> > 
> > We have an difficult position on whether to take things or not as we
> > probably don't have the time/experience to tell in many cases and not
> > taking a CVE fix means we'd get beaten over the head with the patch for
> > ever more as "there is a security problem" :(.
> 
> Perfectly understandable.
> 
> By the way, I suggest applying this patch as well [1]. In the 9.11
> release, short writes could cause issues with 'tee'. It was a silly
> mistake on my part, and cause SUSE some issues.
> 
> The patch applies with NEWS removed. E.g., like this:
> 
>    $ sed '1,49d' 0d6fcb99d691d920961938e61c43478566ef626e.patch > fix.patch
>    $ patch -p1 < fix.patch

Thanks for the pointer!

I've put that in the queue to add.

Cheers,

Richard