[Buildroot] [git commit] package/{binutils, gpsd, micropython, net-tools, util-linux, x11vnc}: fix CVE patch information

[Thomas Petazzoni]

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/636f69ab450e9d1bf48eda22b507a68272c5c9d5
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master

Prior to improving check-package to verify that the comment preceding
a <pkg>_IGNORE_CVES entry mentions an existing patch, and that the
patch itself contains a CVE: tag, we fix all problematic cases that
currently exist in Buildroot:

- In the case of binutils: the CVE was only applicable to binutils
  2.43/2.44, and the oldest version now supported is 2.45, so the
  patch doesn't exist anymore in Buildroot
- For x11vnc, fix a typo in the patch name
- For gpsd the patches were dropped in [1] as they are included in the
  version bump
- Similarly for micropython, the patches were dropped in [2] along with
  the version bump
- For util-linux, strip the prefix "package/util-linux/", so that the patch
  is relative to the .mk file and can be found by the new check
- Add missing 'CVE:' tag to net-tools patch 0001

[1] 37ef4f862f package/gpsd: bump version to 3.27.2
[2] 28eeca9a98 package/micropython: bump to version 1.28.0

Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni at bootlin.com>
---
 package/binutils/binutils.mk                                        | 3 ---
 package/gpsd/gpsd.mk                                                | 6 ------
 package/micropython/micropython.mk                                  | 3 ---
 .../0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch | 1 +
 package/util-linux/util-linux.mk                                    | 2 +-
 package/x11vnc/x11vnc.mk                                            | 2 +-
 6 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/package/binutils/binutils.mk b/package/binutils/binutils.mk
index ca1bfb89b3..5c5c8fc466 100644
--- a/package/binutils/binutils.mk
+++ b/package/binutils/binutils.mk
@@ -21,9 +21,6 @@ BINUTILS_LICENSE = GPL-3.0+, GPL-2.0+, LGPL-2.1+
 BINUTILS_LICENSE_FILES = COPYING COPYING3 COPYING.LIB
 BINUTILS_CPE_ID_VENDOR = gnu
 
-# 0003-objdump-memleak.patch
-BINUTILS_IGNORE_CVES += CVE-2025-3198
-
 ifeq ($(BINUTILS_FROM_GIT),y)
 BINUTILS_DEPENDENCIES += host-flex host-bison
 HOST_BINUTILS_DEPENDENCIES += host-flex host-bison
diff --git a/package/gpsd/gpsd.mk b/package/gpsd/gpsd.mk
index 27a02c1754..7fd8cec8ab 100644
--- a/package/gpsd/gpsd.mk
+++ b/package/gpsd/gpsd.mk
@@ -14,12 +14,6 @@ GPSD_INSTALL_STAGING = YES
 
 GPSD_DEPENDENCIES = host-scons host-pkgconf
 
-# 0005-drivers-driver_nmea2000.c-Fix-issue-356-skyview-buff.patch
-GPSD_IGNORE_CVES += CVE-2025-67268
-
-# 0006-gpsd-packet.c-Fix-integer-underflow-is-malicious-Nav.patch
-GPSD_IGNORE_CVES += CVE-2025-67269
-
 GPSD_LDFLAGS = $(TARGET_LDFLAGS)
 GPSD_CFLAGS = $(TARGET_CFLAGS)
 GPSD_CXXFLAGS = $(TARGET_CXXFLAGS)
diff --git a/package/micropython/micropython.mk b/package/micropython/micropython.mk
index 044714451c..e260b9fde8 100644
--- a/package/micropython/micropython.mk
+++ b/package/micropython/micropython.mk
@@ -15,9 +15,6 @@ MICROPYTHON_LICENSE_FILES = LICENSE
 MICROPYTHON_DEPENDENCIES = host-python3
 MICROPYTHON_CPE_ID_VENDOR = micropython
 
-# 0004-py-objarray-fix-use-after-free-if-extending-a-bytearray-from-itself.patch
-MICROPYTHON_IGNORE_CVES += CVE-2024-8947
-
 # Use fallback implementation for exception handling on architectures that don't
 # have explicit support.
 ifeq ($(BR2_i386)$(BR2_x86_64)$(BR2_arm)$(BR2_armeb),)
diff --git a/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
index 0a02785f38..1405b5c9e9 100644
--- a/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
+++ b/package/net-tools/0001-CVE-2025-46836-interface.c-Stack-based-Buffer-Overfl.patch
@@ -6,6 +6,7 @@ Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
 
 Coordinated as GHSA-pfwf-h6m3-63wf
 
+CVE: CVE-2025-46836
 Upstream: https://github.com/ecki/net-tools/commit/7a8f42fb20013a1493d8cae1c43436f85e656f2d
 Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
 ---
diff --git a/package/util-linux/util-linux.mk b/package/util-linux/util-linux.mk
index cfcd738bb5..b4175024c4 100644
--- a/package/util-linux/util-linux.mk
+++ b/package/util-linux/util-linux.mk
@@ -37,7 +37,7 @@ UTIL_LINUX_LICENSE_FILES = README.licensing \
 
 UTIL_LINUX_CPE_ID_VENDOR = kernel
 
-# package/util-linux/0003-loopdev-use-openat2-RESOLVE_NO_SYMLINKS-for-backing-.patch
+# 0003-loopdev-use-openat2-RESOLVE_NO_SYMLINKS-for-backing-.patch
 UTIL_LINUX_IGNORE_CVES += CVE-2026-27456
 
 # 0002-autotools-optionally-add-libpthread-to-uuid.pc.patch
diff --git a/package/x11vnc/x11vnc.mk b/package/x11vnc/x11vnc.mk
index 645ef40643..4ec1813430 100644
--- a/package/x11vnc/x11vnc.mk
+++ b/package/x11vnc/x11vnc.mk
@@ -10,7 +10,7 @@ X11VNC_DEPENDENCIES = xlib_libXt xlib_libXext xlib_libXtst libvncserver
 X11VNC_LICENSE = GPL-2.0+
 X11VNC_LICENSE_FILES = COPYING
 X11VNC_CPE_ID_VALID = YES
-# 0002-scan-limit-access-to-shared-memory-segments-to-current-user.patch
+# 0002-scan-limit-access-to-shared-memory-segments-to-curre.patch
 X11VNC_IGNORE_CVES += CVE-2020-29074
 
 # Source coming from github, no configure included