Re: [OE-core] [PATCH] binutils: Set status for CVE-2025-69646 & CVE-2025-69649

[Paul Barker <paul@pbarker.dev>]

[-- Attachment #1: Type: text/plain, Size: 1619 bytes --]

On Mon, 2026-04-06 at 00:05 -0700, Sadineni, Harish via
lists.openembedded.org wrote:
> From: Harish Sadineni <Harish.Sadineni@windriver.com>
> 
> Set CVE_STATUS for CVE-2025-69646 and CVE-2025-69649, as both CVES are already resolved
> in the latest binutils 2.46 version upgrade.
> 
> Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com>
> ---
>  meta/recipes-devtools/binutils/binutils-2.46.inc | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/meta/recipes-devtools/binutils/binutils-2.46.inc b/meta/recipes-devtools/binutils/binutils-2.46.inc
> index ff10050dd9..dc8b6be03e 100644
> --- a/meta/recipes-devtools/binutils/binutils-2.46.inc
> +++ b/meta/recipes-devtools/binutils/binutils-2.46.inc
> @@ -34,3 +34,6 @@ SRC_URI = "\
>       file://0013-Define-alignof-using-_Alignof-when-using-C11-or-newe.patch \
>       file://0014-Remove-duplicate-pe-dll.o-entry-deom-targ_extra_ofil.patch \
>  "
> +
> +CVE_STATUS[CVE-2025-69646] = "fixed-version: Fixed from version 2.46"

Hi Harish,

According to https://nvd.nist.gov/vuln/detail/CVE-2025-69646, the CPE
for CVE-2025-69646 is "cpe:2.3:a:gnu:binutils:2.44:*:*:*:*:*:*:*", so it
should already be seen as fixed in 2.46. Which tool is reporting this as
an unresolved CVE?

> +CVE_STATUS[CVE-2025-69649] = "fixed-version: Fixed from version 2.46"

According to https://nvd.nist.gov/vuln/detail/CVE-2025-69649, the CPE
for this one is "cpe:2.3:a:gnu:binutils:*:*:*:*:*:*:*:*". Please include
some info/links in the commit message to confirm that this was fixed for
v2.46.

Best regards,

-- 
Paul Barker


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]