mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-11 21:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

ghostscript: fix CVE-2018-17961

Browse Source 
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a
sandbox protection mechanism via vectors involving errorhandler
setup. NOTE: this issue exists because of an incomplete fix for
CVE-2018-17183.

(From OE-Core rev: 6c32ea184941d292cd8f0eb898e6cc90120ada40)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Hongxu Jia
2018-11-05 16:03:35 +08:00
committed by Richard Purdie
parent 918c8a13b6
commit e84345d6e6
6 changed files with 806 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
meta/recipes-extended/ghostscript/ghostscript_9.25.bb
View File

@@ -25,6 +25,11 @@ SRC_URI_BASE = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/d
file://do-not-check-local-libpng-source.patch \
file://avoid-host-contamination.patch \
file://mkdir-p.patch \
file://0001-Bug-699795-add-operand-checking-to-.setnativefontmap.patch \
file://0002-Bug-699816-Improve-hiding-of-security-critical-custo.patch \
file://0003-Bug-699832-add-control-over-hiding-error-handlers.patch \
file://0004-For-hidden-operators-pass-a-name-object-to-error-han.patch \
file://0005-Bug-699938-.loadfontloop-must-be-an-operator.patch \
"
SRC_URI = "${SRC_URI_BASE} \