mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-13 09:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

ghostscript: fix CVE-2018-18073

Browse Source 
Artifex Ghostscript allows attackers to bypass a sandbox protection
mechanism by leveraging exposure of system operators in the saved
execution stack in an error object.

(From OE-Core rev: 6098c19e1f179896af7013c4b5db3081549c97bc)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hongxu Jia
2018-11-05 16:03:36 +08:00
committed by Richard Purdie
parent e84345d6e6
commit 9e2e38d349
3 changed files with 241 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
meta/recipes-extended/ghostscript/ghostscript_9.25.bb
View File

@@ -30,6 +30,8 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
file://0003-Bug-699832-add-control-over-hiding-error-handlers.patch \
file://0004-For-hidden-operators-pass-a-name-object-to-error-han.patch \
file://0005-Bug-699938-.loadfontloop-must-be-an-operator.patch \
file://0006-Undefine-some-additional-internal-operators.patch \
file://0007-Bug-699927-don-t-include-operator-arrays-in-execstac.patch \
"
SRC_URI = "${SRC_URI_BASE} \