linux/poky.git/meta/recipes-extended/ghostscript, branch yocto-2.3.4

ghostscript: CVE-2017-9727, -9835, -11714

2017-09-11T21:15:58+00:00

CVE-2017-9727: make bounds check in gx_ttfReader__Read more robust CVE-2017-9835: bounds check the array allocations methods CVE-2017-11714: prevent trying to reloc a freed object (From OE-Core rev: 2eae91f9fa1cfdd3f0e6111956c8f193fd0db69f) (From OE-Core rev: 1c9e3318791e36d6bc851192a7640ee639f61f23) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ghostscript: fix several CVEs by adding bounds checking

2017-09-11T21:15:58+00:00

CVE-2017-9611 CVE-2017-9612 CVE-2017-9739 CVE-2017-9726 (From OE-Core rev: 3e5d80c84f4c141bc3f3193d1db899b0e56993cf) (From OE-Core rev: 7fe1e9d46954f082af4debfa63cd982558dbf965) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ghostscript: CVE-2016-7977, CVE-2016-7978, CVE-2016-7979, CVE-2017-9216

2017-06-05T22:30:22+00:00

Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently read arbitrary files via the use of the .libfile operator in a crafted postscript document. Use-after-free vulnerability in Ghostscript 9.20 might allow remote attackers to execute arbitrary code via vectors related to a reference leak in .setdevice. Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser. libjbig2dec.a in Artifex jbig2dec 0.13, as used in MuPDF and Ghostscript, has a NULL pointer dereference in the jbig2_huffman_get function in jbig2_huffman.c. For example, the jbig2dec utility will crash (segmentation fault) when parsing an invalid file. References: https://nvd.nist.gov/vuln/detail/CVE-2016-7977 https://nvd.nist.gov/vuln/detail/CVE-2016-7978 https://nvd.nist.gov/vuln/detail/CVE-2016-7979 https://nvd.nist.gov/vuln/detail/CVE-2017-9216 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=8abd22010eb4db0fb1b10e430d5f5d83e015ef70 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=6f749c0c44e7b9e09737b9f29edf29925a34f0cf http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=875a0095f37626a721c7ff57d606a0f95af03913 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=3ebffb1d96ba0cacec23016eccb4047dab365853 (From OE-Core rev: 584dfa2f780d5785aaff01f84fbabc18b3478d76) (From OE-Core rev: 6fed7cd6077c46ad2213226d4675fad9b10ab024) Signed-off-by: Catalin Enache Signed-off-by: Richard Purdie

ghostscript: CVE-2016-8602, CVE-2017-7975

2017-06-05T22:30:21+00:00

The .sethalftone5 function in psi/zht2.c in Ghostscript before 9.21 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Postscript document that calls .sethalftone5 with an empty operand stack. Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table function in jbig2_huffman.c during operations on a crafted JBIG2 file, leading to a denial of service (application crash) or possibly execution of arbitrary code. References: https://nvd.nist.gov/vuln/detail/CVE-2016-8602 https://nvd.nist.gov/vuln/detail/CVE-2017-7975 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=f5c7555c303 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5e57e483298 (From OE-Core rev: 8f919c2df47ca93132f21160d919b6ee2207d9a6) (From OE-Core rev: 6040b8735b79397bf49a2154f81e9aab34c15413) Signed-off-by: Catalin Enache Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ghostscript : CVE-2016-10219, CVE-2016-10220, CVE-2017-5951

2017-04-29T10:17:23+00:00

The intersect function in base/gxfill.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file. The gs_makewordimagedevice function in base/gsdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file that is mishandled in the PDF Transparency module. The mem_get_bits_rectangle function in base/gdevmem.c in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10219 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10220 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5951 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;h=4bef1a1d32e29b68855616020dbff574b9cda08f http://git.ghostscript.com/?p=ghostpdl.git;h=daf85701dab05f17e924a48a81edc9195b4a04e8 http://git.ghostscript.com/?p=ghostpdl.git;h=bfa6b2ecbe48edc69a7d9d22a12419aed25960b8 (From OE-Core rev: 6679a4d4379f6f18554ed0042546cce94d5d0b19) Signed-off-by: Catalin Enache Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ghostscript: CVE-2017-7207

2017-04-10T22:00:42+00:00

The mem_get_bits_rectangle function in Artifex Software, Inc. Ghostscript 9.20 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted PostScript document. Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7207 Upstream patch: http://git.ghostscript.com/?p=ghostpdl.git;h=309eca4e0a31ea70dcc844812691439312dad091 (From OE-Core rev: 0f22a27c2abd2f2dd9119681f139dd85dcb6479d) Signed-off-by: Catalin Enache Signed-off-by: Richard Purdie

ghostscript: fix upstream version check

2016-12-17T09:57:04+00:00

(From OE-Core rev: 10001924baf112a4556c5e85c16c482cbf435950) (From OE-Core rev: 4e8e884054b56c578d51d7b4af7150b77806368d) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ghostscript 9.19 -> 9.20

2016-12-17T09:57:03+00:00

1)Upgrade ghostscript from 9.19 to 9.20. 2)Modify ghostscript-9.15-parallel-make.patch, since the data has been changed. (From OE-Core rev: 4f3483c3a0ba22f46d768d78d6f56880e8ac5608) (From OE-Core rev: 9133ba6b8138951f3ef798f0a1cc6f694fe71868) Signed-off-by: Huang Qiyu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ghostscript: Use MIPS MACHINE_OVERRIDES for objarch.h

2016-11-30T15:48:07+00:00

MIPS MACHINE_OVERRIDES can be used to provide the same objarch.h files for MIPS pre-R2 and R6 ISA versions. Use them to reduce duplication in supporting MIPS R6 ISA (From OE-Core rev: a169f11cee3f4288467120cbc363f5e664b86f0c) Signed-off-by: Zubair Lutfullah Kakakhel Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ghostscript: Reduce duplication in MIPS variants.

2016-11-15T15:19:53+00:00

Reduce duplication in MIPS variants now that the MACHINEOVERRIDES variable is defined (From OE-Core rev: c4aefe37ef5ff34ebd8e1a077c9198dcf3634e07) Signed-off-by: Zubair Lutfullah Kakakhel Signed-off-by: Ross Burton Signed-off-by: Richard Purdie