On Fri, 2026-07-31 at 17:11 -0700, Collin Funk via lists.openembedded.org wrote: > Leonid Iziumtsev said: > > > This series backports upstream fixes to coreutils 9.11 to address > > multiple CVEs. > > > > Leonid Iziumtsev (2): > > coreutils: fix CVE-2026-56391 > > coreutils: fix CVE-2026-56392 > > > > .../coreutils/coreutils/CVE-2026-56391.patch | 66 +++++++++++++++++++ > > .../coreutils/coreutils/CVE-2026-56392.patch | 65 ++++++++++++++++++ > > meta/recipes-core/coreutils/coreutils_9.11.bb | 2 + > > 3 files changed, 133 insertions(+) > > create mode 100644 > > meta/recipes-core/coreutils/coreutils/CVE-2026-56391.patch > > create mode 100644 > > meta/recipes-core/coreutils/coreutils/CVE-2026-56392.patch > > Note that CVEs don't really have a security impact. I'm mildly annoyed > there were assigned. It seems that Afine's entire existence as a company > is sending LLM generated essays to maintainers, bogus a large portion of > the time. For the others, which have dubious security implications, they > file CVEs with exaggerations [1]. > > Theoretically CVE-2026-56392 could allow problematic writes to the heap, > but that would require you to run it with untrusted slop as the input > and as arguments. If someone can do that on your system, they have much > better things to do.
Sadly, I suspect this is becoming all the more common and I share your frustrations. We have an difficult position on whether to take things or not as we probably don't have the time/experience to tell in many cases and not taking a CVE fix means we'd get beaten over the head with the patch for ever more as "there is a security problem" :(. Cheers, Richard
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242477): https://lists.openembedded.org/g/openembedded-core/message/242477 Mute This Topic: https://lists.openembedded.org/mt/120532929/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
