gstreamer1.0: set status of CVE-2025-3887 to patched

This CVE was fixed in plugins-bad.
See [1] and [2] which is included in 1.24.13.
These commits are backport of [3] to 1.24.
Commits fixing this CVE were copied from [4].

[1] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/e4351ef03f1331410b0c1216a6178d885f37e495
[2] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/ed4c2ce380f7168bd4a3423f4398eb341cb931c7
[3] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8884
[4] https://security-tracker.debian.org/tracker/CVE-2025-3887

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

diff --git a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.24.13.bb b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.24.13.bb
index 71a360ae7b33676b3a5156aad8b1e05765c34ca7..d15b7daab8c9b85553053d1246e44370c351a1a4 100644 (file)
--- a/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.24.13.bb
+++ b/meta/recipes-multimedia/gstreamer/gstreamer1.0_1.24.13.bb
@@ -77,4 +77,8 @@ CVE_STATUS_STABLE_BACKPORT[status] = "cpe-stable-backport: these CVEs are patche
 
 CVE_STATUS[CVE-2025-2759] = "not-applicable-platform: affects installation packages for non Linux OSes"
 
+CVE_STATUS_GROUPS += "CVE_STATUS_PLUGINS_BAD"
+CVE_STATUS_PLUGINS_BAD = "CVE-2025-3887"
+CVE_STATUS_PLUGINS_BAD[status] = "cpe-incorrect: these CVEs is patched in current version of gstreamer1.0-plugins-bad"
+
 PTEST_BUILD_HOST_FILES = ""