diff options
| author | Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech> | 2026-03-31 14:12:24 +0200 |
|---|---|---|
| committer | Paul Barker <paul@pbarker.dev> | 2026-05-04 13:57:31 +0100 |
| commit | 48269c1e3f598255ddcce6d24f53c14a8928e625 (patch) | |
| tree | 3d37b646cd56720f75623f96543e817f1e124b44 | |
| parent | db52236af1f12fb1a7c746823d24b86ea3e656e0 (diff) | |
| download | poky-48269c1e3f598255ddcce6d24f53c14a8928e625.tar.gz | |
binutils: mark CVE-2025-69650 and CVE-2025-69651 as disputed
Both CVEs are disputed by third parties. The observed behavior
(double free / invalid pointer free in readelf) only occurred in
pre-release code and did not affect any tagged version [1][2].
CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version"
CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version"
[1] https://www.cve.org/CVERecord?id=CVE-2025-69650
[2] https://www.cve.org/CVERecord?id=CVE-2025-69651
(From OE-Core rev: 55a0d8abad8a81f7d900557c2eb2d9327ee115df)
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
(cherry picked from commit 9c6df56fe18237880c391798c2083dca595566f4)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
| -rw-r--r-- | meta/recipes-devtools/binutils/binutils-2.42.inc | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index 839d31242e..e27502af72 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc | |||
| @@ -20,6 +20,8 @@ UPSTREAM_CHECK_GITTAGREGEX = "binutils-(?P<pver>\d+_(\d_?)*)" | |||
| 20 | 20 | ||
| 21 | CVE_STATUS[CVE-2023-25584] = "cpe-incorrect: Applies only for version 2.40 and earlier" | 21 | CVE_STATUS[CVE-2023-25584] = "cpe-incorrect: Applies only for version 2.40 and earlier" |
| 22 | CVE_STATUS[CVE-2025-1180] = "patched: fixed by patch for CVE-2025-1176" | 22 | CVE_STATUS[CVE-2025-1180] = "patched: fixed by patch for CVE-2025-1176" |
| 23 | CVE_STATUS[CVE-2025-69650] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" | ||
| 24 | CVE_STATUS[CVE-2025-69651] = "disputed: observed behavior only in pre-release code, does not affect any tagged version" | ||
| 23 | 25 | ||
| 24 | SRCREV ?= "f9488b0d92b591bdf3ff8cce485cb0e1b3727cc0" | 26 | SRCREV ?= "f9488b0d92b591bdf3ff8cce485cb0e1b3727cc0" |
| 25 | BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" | 27 | BINUTILS_GIT_URI ?= "git://sourceware.org/git/binutils-gdb.git;branch=${SRCBRANCH};protocol=https" |