<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 6 October 2015 at 09:11, Petter Mabäcker <span dir="ltr"><<a href="mailto:petter@technux.se" target="_blank">petter@technux.se</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><p>I played around with the new meta-security-isafw layer and the cve-check-tool. In readline the cve CVE-2014-2524 is marked as 'missing' by the framework and I was confused to start with, since I saw that this commit was included. But after looking at the actual patch I realized that it only contains a report and not the patch itself. My question is if that is with purpose and due to some decision that the CVE isn't really causing any harm or if it's by mistake?</p>
<p></p></blockquote></div><br>As can be seen at <a href="http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html">http://lists.gnu.org/archive/html/bug-readline/2014-03/msg00057.html</a> the CVE patch is simply adding a #if defined (DEBUG), which is in the patch included in oe-core master as readline-6.3/readline63-003.</div><div class="gmail_extra"><br></div><div class="gmail_extra">The tool is probably reporting it as missing as -- if i recall correctly -- it identifies CVE patches by filename.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Ross</div></div>