libgsf: Upgrade 1.14.49 -> 1.14.53

Changelog:
libgsf 1.14.53
* Compilation fixes for libxml 2.13
* Fix ABR in gsf-vba-dump.
* Teach gsf (the tool) to handle odf properties.
* Fix integer overflows affecting memory allocation.
* Add missing "DocumentStatus" ole2 property.
* Avoid some undefined C behaviour in overflow checks.
libgsf 1.14.51
* Fix thumbnailer crash.
* Fix leaks.
libgsf 1.14.50
* Fix error handling problem when writing ole files.

License changed to LGPL-2.1-only from 1.14.51
[https://gitlab.gnome.org/GNOME/libgsf/-/commit/037c913eb631349c410ef45e49697bf5c46dac8a]

remove obsolete DEPENDS from upstream [103f49b5fc987e7bb8765700d16bd387a33b62ca]

Security fixes:
CVE-2024-42415
An integer overflow vulnerability exists in the Compound Document Binary
File format parser of v1.14.52 of the GNOME Project G Structured File
Library (libgsf). A specially crafted file can result in an integer
overflow that allows for a heap-based buffer overflow when processing
the sector allocation table. This can lead to arbitrary code execution.
An attacker can provide a malicious file to trigger this vulnerability.
CVE-2024-36474
An integer overflow vulnerability exists in the Compound Document Binary
File format parser of the GNOME Project G Structured File Library
(libgsf) version v1.14.52. A specially crafted file can result in an
integer overflow when processing the directory from the file that allows
for an out-of-bounds index to be used when reading and writing to an
array. This can lead to arbitrary code execution. An attacker can
provide a malicious file to trigger this vulnerability.

Reference:
[https://gitlab.gnome.org/GNOME/libgsf/-/issues/34]

(master rev: 6ed5891c18fc78a69764af0a29ad9b5feefb1aa8)

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

0 files changed, 0 insertions, 0 deletions