Lee Chee Yang
1cd36a832e
ghostscript : fix CVE-2019-10216
...
(From OE-Core rev: 4620180a073b721dbc91d14ab64285187bec4cb7)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com >
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2020-06-02 13:32:49 +01:00
Stefan Ghinea
bb702471b5
ghostscript: CVE-2019-14869
...
A flaw was found in all versions of ghostscript 9.x before 9.28,
where the `.charkeys` procedure, where it did not properly secure
its privileged calls, enabling scripts to bypass `-dSAFER` restrictions.
An attacker could abuse this flaw by creating a specially crafted
PostScript file that could escalate privileges within the Ghostscript
and access files outside of restricted areas or execute commands.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-14869
Upstream patches:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904
(From OE-Core rev: 0bb88ac63b4e1728373c6425477a32f7a6362b2c)
(From OE-Core rev: 9827b7df6f008f4384bbe22beeb0fe6adfeb36d6)
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com >
Signed-off-by: Ross Burton <ross.burton@intel.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2019-12-06 14:49:33 +00:00
Khem Raj
0221e2e6e1
ghostscript: Disable libpaper
...
OE does not provide libpaper recipe, and the configure check looks for
libpaper if not disabled, this causes problems especially when shared
state is built on a machine which has libpaper installed on host but the
consumer machine although running same OS, but does not have libpaper
installed, the artifact from sstate are re-used but then native binary
./obj/aux/packps fails to execute
./obj/aux/packps: error while loading shared libraries: libpaper.so.1: cannot open shared object file: No such file or directory
So either we need to provide libpaper in OE or we disable it, disabling
is best for now
(From OE-Core rev: 11e85220d97299be5f65d5208ec21d4ad215317a)
Signed-off-by: Khem Raj <raj.khem@gmail.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2019-10-08 11:22:24 +01:00
Stefan Ghinea
7f87451e6e
ghostscript: CVE-2019-14811, CVE-2019-14817
...
A flaw was found in, ghostscript versions prior to 9.28,
in the .pdf_hook_DSC_Creator procedure where it did not
properly secure its privileged calls, enabling scripts to
bypass `-dSAFER` restrictions. A specially crafted PostScript
file could disable security protection and then have access
to the file system, or execute arbitrary commands.
A flaw was found in, ghostscript versions prior to 9.28,
in the .pdfexectoken and other procedures where it did not
properly secure its privileged calls, enabling scripts to
bypass `-dSAFER` restrictions. A specially crafted PostScript
file could disable security protection and then have access
to the file system, or execute arbitrary commands.
References:
https://nvd.nist.gov/vuln/detail/CVE-2019-14811
https://nvd.nist.gov/vuln/detail/CVE-2019-14817
Upstream patches:
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33
http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19
(From OE-Core rev: 1533b92848ea73d6fe6ba22d87d7b6749b47842c)
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com >
Signed-off-by: Ross Burton <ross.burton@intel.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2019-09-16 23:02:44 +01:00
Hongxu Jia
7e4ca0f722
ghostscript: 9.26 -> 9.27
...
- Rebase ghostscript-9.02-genarch.patch
- Drop backported CVE patches
(From OE-Core rev: 62510fc82a8eee19bfc51d7b5bc1c6f2aec3825b)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2019-05-12 17:55:11 +01:00
