diff options
| author | Gyorgy Sarvari <skandigraun@gmail.com> | 2025-12-25 17:35:09 +0100 |
|---|---|---|
| committer | Khem Raj <raj.khem@gmail.com> | 2025-12-25 11:25:58 -0800 |
| commit | f691f2178b15eec22f09a1c17b9945fad4e330e6 (patch) | |
| tree | ba5f79095a0600cd01034967cdd4c9fc7ead064b /meta-oe/recipes-graphics/tigervnc | |
| parent | fadb9c05709dae9e817a50e4d99093d4e2937933 (diff) | |
| download | meta-openembedded-f691f2178b15eec22f09a1c17b9945fad4e330e6.tar.gz | |
tigervnc: ignore CVE-2023-6377
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-6377
TigerVNC compiles its own xserver, this is why this CVE is associated
with it - despite the vulnerability being in xserver.
The vulnerability was fixed by [1] (from the nvd report), which has been
backported[2] to the xserver version used by the recipe - so ignore the
CVE, since it's patched already.
[1]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd
[2]: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a7bda3080d2b44eae668cdcec7a93095385b9652
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Diffstat (limited to 'meta-oe/recipes-graphics/tigervnc')
| -rw-r--r-- | meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb index 0adaf70b98..4455050631 100644 --- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb +++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.15.0.bb | |||
| @@ -87,3 +87,4 @@ FILES:${PN} += " \ | |||
| 87 | SYSTEMD_SERVICE:${PN} = "vncserver@.service" | 87 | SYSTEMD_SERVICE:${PN} = "vncserver@.service" |
| 88 | 88 | ||
| 89 | CVE_STATUS[CVE-2014-8241] = "fixed-version: The vulnerable code is not present in the used version (1.15.0)" | 89 | CVE_STATUS[CVE-2014-8241] = "fixed-version: The vulnerable code is not present in the used version (1.15.0)" |
| 90 | CVE_STATUS[CVE-2023-6377] = "fixed-version: The vulnerable code is not present in the used xserver version (21.1.18)" | ||