pool/ghostscript
SHA256
3
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add overseen fix for CVE-2019-10216

Browse Source 
OBS-URL: https://build.opensuse.org/package/show/Printing/ghostscript?expand=0&rev=120
This commit is contained in:
Dr. Werner Fink 2019-09-16 13:20:05 +00:00 committed by Git OBS Bridge
parent d137c48cfe
commit 9db5869058
5 changed files with 76 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
CVE-2019-10216.patch Normal file
View File

@ -0,0 +1,44 @@
From 5b85ddd19a8420a1bd2d5529325be35d78e94234 Mon Sep 17 00:00:00 2001
From: Chris Liddell <chris.liddell@artifex.com>
Date: Fri, 2 Aug 2019 15:18:26 +0100
Subject: [PATCH] Bug 701394: protect use of .forceput with executeonly
---
Resource/Init/gs_type1.ps | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- Resource/Init/gs_type1.ps
+++ Resource/Init/gs_type1.ps 2019-09-16 13:09:12.277074046 +0000
@@ -118,25 +118,25 @@
( to be the same as glyph: ) print 1 index //== exec } if
3 index exch 3 index .forceput
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
- }
+ }executeonly
{pop} ifelse
- } forall
+ } executeonly forall
pop pop
- }
+ } executeonly
{
pop pop pop
} ifelse
- }
+ } executeonly
{
% scratch(string) RAGL(dict) AGL(dict) CharStrings(dict) cstring gname
pop pop
} ifelse
- } forall
+ } executeonly forall
3 1 roll pop pop
- } if
+ } executeonly if
pop
dup /.AGLprocessed~GS //true .forceput
- } if
+ } executeonly if
%% We need to excute the C .buildfont1 in a stopped context so that, if there
%% are errors we can put the stack back sanely and exit. Otherwise callers won't

8
ghostscript-mini.changes
View File

@ -24,6 +24,14 @@ Tue Aug 13 12:38:45 UTC 2019 - Dr. Werner Fink <werner@suse.de>
/usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
use this with its wrapper script use this with its wrapper script
-------------------------------------------------------------------
Mon Aug 12 11:32:08 UTC 2019 - Dr. Werner Fink <werner@suse.de>
- CVE-2019-10216.patch fixes CVE-2019-10216
forceput/superexec in .buildfont1 is still accessible
https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
https://bugs.ghostscript.com/show_bug.cgi?id=701394
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Apr 4 14:37:09 CEST 2019 - jsmeix@suse.de Thu Apr 4 14:37:09 CEST 2019 - jsmeix@suse.de

12
ghostscript-mini.spec
View File

@ -80,10 +80,12 @@ Source1: apparmor_ghostscript
# Patch0...Patch9 is for patches from upstream: # Patch0...Patch9 is for patches from upstream:
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616 # Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch
# Patch1 Add commit from of upstream to fix CVE-2019-10216
Patch1: CVE-2019-10216.patch
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813 # Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
Patch1: gs-CVE-2019-14811-885444fc.patch Patch2: gs-CVE-2019-14811-885444fc.patch
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817 # Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
Patch2: gs-CVE-2019-14817-cd1b1cac.patch Patch3: gs-CVE-2019-14817-cd1b1cac.patch
# Source10...Source99 is for sources from SUSE which are intended for upstream: # Source10...Source99 is for sources from SUSE which are intended for upstream:
# Patch10...Patch99 is for patches from SUSE which are intended for upstream: # Patch10...Patch99 is for patches from SUSE which are intended for upstream:
# Source100...Source999 is for sources from SUSE which are not intended for upstream: # Source100...Source999 is for sources from SUSE which are not intended for upstream:
@ -153,10 +155,12 @@ This package contains the development files for Minimal Ghostscript.
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616 # Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
# openjpeg4gs-CVE-2018-6616-8ee33522.patch # openjpeg4gs-CVE-2018-6616-8ee33522.patch
%patch0 %patch0
# Patch1 Add commit from of upstream to fix CVE-2019-10216
%patch1 -p0
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813 # Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
%patch1 -p1
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
%patch2 -p1 %patch2 -p1
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
%patch3 -p1
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h # Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball. # in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball.
# Again use the zlib sources from Ghostscript upstream # Again use the zlib sources from Ghostscript upstream

8
ghostscript.changes
View File

@ -24,6 +24,14 @@ Tue Aug 13 12:38:45 UTC 2019 - Dr. Werner Fink <werner@suse.de>
/usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to /usr/bin/gs to /usr/bin/gs.bin and allow the gswrap package to
use this with its wrapper script use this with its wrapper script
-------------------------------------------------------------------
Mon Aug 12 11:32:08 UTC 2019 - Dr. Werner Fink <werner@suse.de>
- CVE-2019-10216.patch fixes CVE-2019-10216
forceput/superexec in .buildfont1 is still accessible
https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
https://bugs.ghostscript.com/show_bug.cgi?id=701394
------------------------------------------------------------------- -------------------------------------------------------------------
Wed May 8 08:46:43 UTC 2019 - jsegitz@suse.com Wed May 8 08:46:43 UTC 2019 - jsegitz@suse.com

12
ghostscript.spec
View File

@ -102,10 +102,12 @@ Source1: apparmor_ghostscript
# Patch0...Patch9 is for patches from upstream: # Patch0...Patch9 is for patches from upstream:
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616 # Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch Patch0: openjpeg4gs-CVE-2018-6616-8ee33522.patch
# Patch1 Add commit from of upstream to fix CVE-2019-10216
Patch1: CVE-2019-10216.patch
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813 # Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
Patch1: gs-CVE-2019-14811-885444fc.patch Patch2: gs-CVE-2019-14811-885444fc.patch
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817 # Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
Patch2: gs-CVE-2019-14817-cd1b1cac.patch Patch3: gs-CVE-2019-14817-cd1b1cac.patch
# Source10...Source99 is for sources from SUSE which are intended for upstream: # Source10...Source99 is for sources from SUSE which are intended for upstream:
# Patch10...Patch99 is for patches from SUSE which are intended for upstream: # Patch10...Patch99 is for patches from SUSE which are intended for upstream:
# Source100...Source999 is for sources from SUSE which are not intended for upstream: # Source100...Source999 is for sources from SUSE which are not intended for upstream:
@ -288,10 +290,12 @@ This package contains the development files for Ghostscript.
# Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616 # Patch0 Add commit from openjpeg upstream to fix CVE-2018-6616
# openjpeg4gs-CVE-2018-6616-8ee33522.patch # openjpeg4gs-CVE-2018-6616-8ee33522.patch
%patch0 %patch0
# Patch1 Add commit from of upstream to fix CVE-2019-10216
%patch1 -p0
# Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813 # Patch1 Add commit from ghostscript upstream to fix CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
%patch1 -p1
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
%patch2 -p1 %patch2 -p1
# Patch2 Add commit from ghostscript upstream to fix CVE-2019-14817
%patch3 -p1
# Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h # Patch100 remove-zlib-h-dependency.patch removes dependency on zlib/zlib.h
# in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball. # in makefiles as we do not use the zlib sources from the Ghostscript upstream tarball.
# Again use the zlib sources from Ghostscript upstream # Again use the zlib sources from Ghostscript upstream