These CVEs are disputed by upstream and there is no plan to fix/address them. No
other distros are carrying patches for them. There is a patch for 1010025
however it isn't merged upstream and probably carries more risk of other bugs
than not having it.
(From OE-Core rev: e764a689844f19230cbf5f9741635f42f677e333)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>