Leonid Iziumtsev said: > This series backports upstream fixes to coreutils 9.11 to address > multiple CVEs. > > Leonid Iziumtsev (2): > coreutils: fix CVE-2026-56391 > coreutils: fix CVE-2026-56392 > > .../coreutils/coreutils/CVE-2026-56391.patch | 66 +++++++++++++++++++ > .../coreutils/coreutils/CVE-2026-56392.patch | 65 ++++++++++++++++++ > meta/recipes-core/coreutils/coreutils_9.11.bb | 2 + > 3 files changed, 133 insertions(+) > create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch > create mode 100644 meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch
Note that CVEs don't really have a security impact. I'm mildly annoyed there were assigned. It seems that Afine's entire existence as a company is sending LLM generated essays to maintainers, bogus a large portion of the time. For the others, which have dubious security implications, they file CVEs with exaggerations [1]. Theoretically CVE-2026-56392 could allow problematic writes to the heap, but that would require you to run it with untrusted slop as the input and as arguments. If someone can do that on your system, they have much better things to do. Collin [1] https://seclists.org/oss-sec/2026/q3/276
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242456): https://lists.openembedded.org/g/openembedded-core/message/242456 Mute This Topic: https://lists.openembedded.org/mt/120532929/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
