mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-23 21:43:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

package/ghostscript: security bump to version 10.02.0

Browse Source 
- Fix CVE-2023-36664: Artifex Ghostscript through 10.01.2 mishandles
  permission validation for pipe devices (with the %pipe% prefix or the |
  pipe character prefix).
- Fix CVE-2023-38559: A buffer overflow flaw was found in
  base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This
  issue may allow a local attacker to cause a denial of service via
  outputting a crafted PDF file for a DEVN device with gs.
- Fix CVE-2023-38560: An integer overflow flaw was found in
  pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may
  allow a local attacker to cause a denial of service via transforming a
  crafted PCL file to PDF format.

https://ghostscript.readthedocs.io/en/gs10.02.0/News.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Fabrice Fontaine 2023-09-20 19:07:11 +02:00 committed by Yann E. MORIN
parent 334d807848
commit 93ef6997ae
3 changed files with 37 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
package/ghostscript/0001-Fix-build-without-BUILD_PDF.patch Normal file
View File

@ -0,0 +1,34 @@
From 088f3cd6e58cff5fa51e072d1829f7691a5f6681 Mon Sep 17 00:00:00 2001
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Date: Wed, 20 Sep 2023 13:44:28 +0100
Subject: [PATCH] Fix build without BUILD_PDF
The PDFSetParams PostScript extension operator was missing a stub function definition
when the PDF interpreter is not built in.
Author: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Upstream: https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=088f3cd6e58cff5fa51e072d1829f7691a5f6681
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
psi/zpdfops.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/psi/zpdfops.c b/psi/zpdfops.c
index e7e0a42ee..271687a18 100644
--- a/psi/zpdfops.c
+++ b/psi/zpdfops.c
@@ -1507,6 +1507,11 @@ static int zPDFdrawannots(i_ctx_t *i_ctx_p)
return_error(gs_error_undefined);
}
+static int zPDFSetParams(i_ctx_t *i_ctx_p)
+{
+ return_error(gs_error_undefined);
+}
+
static int zPDFInit(i_ctx_t *i_ctx_p)
{
return_error(gs_error_undefined);
--
2.34.1

4
package/ghostscript/ghostscript.hash
View File

@ -1,5 +1,5 @@
# From https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs10012/SHA512SUMS
sha512 ee20f0e12f553a3d04578e71a0d45defebc71117ce4dc2c14043985bfe7348ad7f8b2fe98fc9b4f5b935ecb32e50dc340be67d6ef58190542ec6d0f9da1de380 ghostscript-10.01.2.tar.xz
# From https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs10020/SHA512SUMS
sha512 c49344151063e915add55a0a842c2a645d8362a5cbca663bd07638f4bd3699a08cade37a9efe905ad5a41e014353e5e1b1268b7925e43128ad30d5b031396b71 ghostscript-10.02.0.tar.xz
# Hash for license file:
sha256 8ce064f423b7c24a011b6ebf9431b8bf9861a5255e47c84bfb23fc526d030a8b LICENSE

2
package/ghostscript/ghostscript.mk
View File

@ -4,7 +4,7 @@
#
################################################################################
GHOSTSCRIPT_VERSION = 10.01.2
GHOSTSCRIPT_VERSION = 10.02.0
GHOSTSCRIPT_SOURCE = ghostscript-$(GHOSTSCRIPT_VERSION).tar.xz
GHOSTSCRIPT_SITE = https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs$(subst .,,$(GHOSTSCRIPT_VERSION))
GHOSTSCRIPT_LICENSE = AGPL-3.0