Add overseen fix for CVE-2019-10216
OBS-URL: https://build.opensuse.org/package/show/Printing/ghostscript?expand=0&rev=120
This commit is contained in:
Dr. Werner Fink
Git OBS Bridge
parent
d137c48cfe
commit
9db5869058
44
CVE-2019-10216.patch
Normal file
44
CVE-2019-10216.patch
Normal file
@ -0,0 +1,44 @@
|
||||
From 5b85ddd19a8420a1bd2d5529325be35d78e94234 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Liddell <chris.liddell@artifex.com>
|
||||
Date: Fri, 2 Aug 2019 15:18:26 +0100
|
||||
Subject: [PATCH] Bug 701394: protect use of .forceput with executeonly
|
||||
|
||||
---
|
||||
Resource/Init/gs_type1.ps | 14 +++++++-------
|
||||
1 file changed, 7 insertions(+), 7 deletions(-)
|
||||
|
||||
--- Resource/Init/gs_type1.ps
|
||||
+++ Resource/Init/gs_type1.ps 2019-09-16 13:09:12.277074046 +0000
|
||||
@@ -118,25 +118,25 @@
|
||||
( to be the same as glyph: ) print 1 index //== exec } if
|
||||
3 index exch 3 index .forceput
|
||||
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||
- }
|
||||
+ }executeonly
|
||||
{pop} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
pop pop
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
pop pop pop
|
||||
} ifelse
|
||||
- }
|
||||
+ } executeonly
|
||||
{
|
||||
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
|
||||
pop pop
|
||||
} ifelse
|
||||
- } forall
|
||||
+ } executeonly forall
|
||||
3 1 roll pop pop
|
||||
- } if
|
||||
+ } executeonly if
|
||||
pop
|
||||
dup /.AGLprocessed~GS //true .forceput
|
||||
- } if
|
||||
+ } executeonly if
|
||||
|
||||
%% We need to excute the C .buildfont1 in a stopped context so that, if there
|
||||
%% are errors we can put the stack back sanely and exit. Otherwise callers won't
|
||||
@ -24,6 +24,14 @@ Tue Aug 13 12:38:45 UTC 2019 - Dr. Werner Fink <werner@suse.de>
|
||||
/usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
|
||||
use this with its wrapper script
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 12 11:32:08 UTC 2019 - Dr. Werner Fink <werner@suse.de>
|
||||
|
||||
- CVE-2019-10216.patch fixes CVE-2019-10216
|
||||
forceput/superexec in .buildfont1 is still accessible
|
||||
https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
|
||||
https://bugs.ghostscript.com/show_bug.cgi?id=701394
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Apr 4 14:37:09 CEST 2019 - jsmeix@suse.de
|
||||
|
||||
|
||||
@ -80,10 +80,12 @@ Source1: apparmor_ghostscript
|
||||
# Patch0...Patch9 is for patches from upstream:
|
||||
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
|
||||
Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch
|
||||
# Patch1 Add commit from of upstream to fix CVE-2019-10216
|
||||
Patch1: CVE-2019-10216.patch
|
||||
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
|
||||
Patch1: gs-CVE-2019-14811-885444fc.patch
|
||||
Patch2: gs-CVE-2019-14811-885444fc.patch
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
Patch2: gs-CVE-2019-14817-cd1b1cac.patch
|
||||
Patch3: gs-CVE-2019-14817-cd1b1cac.patch
|
||||
# Source10...Source99 is for sources from SUSE which are intended for upstream:
|
||||
# Patch10...Patch99 is for patches from SUSE which are intended for upstream:
|
||||
# Source100...Source999 is for sources from SUSE which are not intended for upstream:
|
||||
@ -153,10 +155,12 @@ This package contains the development files for Minimal Ghostscript.
|
||||
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
|
||||
# openjpeg4gs-CVE-2018-6616-8ee33522.patch
|
||||
%patch0
|
||||
# Patch1 Add commit from of upstream to fix CVE-2019-10216
|
||||
%patch1 -p0
|
||||
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
|
||||
%patch1 -p1
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
%patch2 -p1
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
%patch3 -p1
|
||||
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
|
||||
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball.
|
||||
# Again use the zlib sources from Ghostscript upstream
|
||||
|
||||
@ -24,6 +24,14 @@ Tue Aug 13 12:38:45 UTC 2019 - Dr. Werner Fink <werner@suse.de>
|
||||
/usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
|
||||
use this with its wrapper script
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 12 11:32:08 UTC 2019 - Dr. Werner Fink <werner@suse.de>
|
||||
|
||||
- CVE-2019-10216.patch fixes CVE-2019-10216
|
||||
forceput/superexec in .buildfont1 is still accessible
|
||||
https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
|
||||
https://bugs.ghostscript.com/show_bug.cgi?id=701394
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 8 08:46:43 UTC 2019 - jsegitz@suse.com
|
||||
|
||||
|
||||
@ -102,10 +102,12 @@ Source1: apparmor_ghostscript
|
||||
# Patch0...Patch9 is for patches from upstream:
|
||||
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
|
||||
Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch
|
||||
# Patch1 Add commit from of upstream to fix CVE-2019-10216
|
||||
Patch1: CVE-2019-10216.patch
|
||||
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
|
||||
Patch1: gs-CVE-2019-14811-885444fc.patch
|
||||
Patch2: gs-CVE-2019-14811-885444fc.patch
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
Patch2: gs-CVE-2019-14817-cd1b1cac.patch
|
||||
Patch3: gs-CVE-2019-14817-cd1b1cac.patch
|
||||
# Source10...Source99 is for sources from SUSE which are intended for upstream:
|
||||
# Patch10...Patch99 is for patches from SUSE which are intended for upstream:
|
||||
# Source100...Source999 is for sources from SUSE which are not intended for upstream:
|
||||
@ -288,10 +290,12 @@ This package contains the development files for Ghostscript.
|
||||
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
|
||||
# openjpeg4gs-CVE-2018-6616-8ee33522.patch
|
||||
%patch0
|
||||
# Patch1 Add commit from of upstream to fix CVE-2019-10216
|
||||
%patch1 -p0
|
||||
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
|
||||
%patch1 -p1
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
%patch2 -p1
|
||||
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
|
||||
%patch3 -p1
|
||||
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
|
||||
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball.
|
||||
# Again use the zlib sources from Ghostscript upstream
|
||||
|
||||
Loading…
Reference in New Issue
Block a user