Re: [OE-core] [scarthgap][PATCH] glib-2.0: fix CVE-2026-58016

[Benjamin Robin <benjamin.robin@bootlin.com>]

On Friday, July 3, 2026 at 3:53 PM, Yoann Congal wrote:
> On Fri Jul 3, 2026 at 3:46 PM CEST, Benjamin Robin wrote:
> > Hello Yoann,
> >
> > On Friday, July 3, 2026 at 3:33 PM, Yoann Congal wrote:
> >> On Fri Jul 3, 2026 at 3:25 PM CEST, Benjamin Robin via lists.openembedded.org wrote:
> >> > ---
> >> >  .../glib-2.0/glib-2.0/CVE-2026-58016-1.patch       | 92 +++++++++++++++++++++
> >> >  .../glib-2.0/glib-2.0/CVE-2026-58016-2.patch       | 96 ++++++++++++++++++++++
> >> >  meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb      |  2 +
> >> 
> >> NVD tells this is fixed in 2.88.1 but wrynose is at 2.88.0. Can you send
> >> a patch for wrynose so I can accept this on scarthgap?
> >
> > The fun thing, that this is not fixed in version 2.88.1 but in 2.89.0.
> 
> Then,
> * NVD is wrong(?). Can you send a modification request so we avoid false
>   negatives (those are the worst ones!)

Yes, this was in my (very) long TODO list.
The commit fixing this issue is [1] and it was never backported.
The version 2.88.2 does not have the fix.

I am going to to that now :)

> * And, in that case, master is also impacted and need a fix.

I have sent:
 - A patch for master upgrading to 2.89.1
 - A patch for wrynose with the patches applied on 2.88.0

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/c9da977c178fbfc0e4caf99f9fdf5dc433d6fcc2

-- 
Benjamin Robin, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com