pool/ghostscript
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1136517 from Printing

Browse Source 
Security fix CVE-2023-46751 bsc#1217871 for ghostscript and ghostscript-mini (forwarded request 1136515 from jsmeix)

OBS-URL: https://build.opensuse.org/request/show/1136517
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/ghostscript?expand=0&rev=63
This commit is contained in:
Dominique Leuenberger 2024-01-04 14:55:37 +00:00 committed by Git OBS Bridge
commit afeca6e327
3 changed files with 48 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
CVE-2023-46751.patch Normal file
View File

@ -0,0 +1,20 @@
--- base/gdevprn.c.orig 2022-04-04 15:48:49.000000000 +0200
+++ base/gdevprn.c 2024-01-03 12:53:20.009504451 +0100
@@ -1268,6 +1268,7 @@ gdev_prn_open_printer_seekable(gx_device
&& !IS_LIBCTX_STDERR(pdev->memory, gp_get_file(ppdev->file))) {
code = gx_device_close_output_file(pdev, ppdev->fname, ppdev->file);
+ ppdev->file = NULL;
if (code < 0)
return code;
}
--- devices/gdevtsep.c.orig 2022-04-04 15:48:49.000000000 +0200
+++ devices/gdevtsep.c 2024-01-03 13:04:42.048210048 +0100
@@ -736,6 +736,7 @@ tiffsep_initialize_device_procs(gx_devic
{
gdev_prn_initialize_device_procs(dev);
+ set_dev_proc(dev, output_page, gdev_prn_output_page_seekable);
set_dev_proc(dev, open_device, tiffsep_prn_open);
set_dev_proc(dev, close_device, tiffsep_prn_close);
set_dev_proc(dev, map_color_rgb, tiffsep_decode_color);

11
ghostscript.changes
View File

@ -1,3 +1,14 @@
-------------------------------------------------------------------
Wed Jan 3 12:15:46 UTC 2024 - Johannes Meixner <jsmeix@suse.com>
- CVE-2023-46751.patch is
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13
adapted for Ghostscript-9.56.1 that fixes
https://bugs.ghostscript.com/show_bug.cgi?id=707264
which includes a fix for CVE-2023-46751
"dangling pointer in gdev_prn_open_printer_seekable()"
(bsc#1217871)
------------------------------------------------------------------- -------------------------------------------------------------------
Mon Dec 18 12:50:20 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org> Mon Dec 18 12:50:20 UTC 2023 - Dominique Leuenberger <dimstar@opensuse.org>

18
ghostscript.spec
View File

@ -1,7 +1,7 @@
# #
# spec file # spec file
# #
# Copyright (c) 2023 SUSE LLC # Copyright (c) 2024 SUSE LLC
# #
# All modifications and additions to the file contributed by third parties # All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed # remain the property of their copyright owners, unless otherwise agreed
@ -83,6 +83,14 @@ Patch104: CVE-2023-38559.patch
# see https://bugs.ghostscript.com/show_bug.cgi?id=707051 # see https://bugs.ghostscript.com/show_bug.cgi?id=707051
# and https://bugzilla.suse.com/show_bug.cgi?id=1215466 # and https://bugzilla.suse.com/show_bug.cgi?id=1215466
Patch105: CVE-2023-43115.patch Patch105: CVE-2023-43115.patch
# Patch106 CVE-2023-46751.patch is
# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13
# adapted for Ghostscript-9.56.1 that fixes
# https://bugs.ghostscript.com/show_bug.cgi?id=707264
# which includes a fix for CVE-2023-46751
# "dangling pointer in gdev_prn_open_printer_seekable()"
# see https://bugzilla.suse.com/show_bug.cgi?id=1217871
Patch106: CVE-2023-46751.patch
# Build Requirements: # Build Requirements:
BuildRequires: freetype2-devel BuildRequires: freetype2-devel
BuildRequires: libjpeg-devel BuildRequires: libjpeg-devel
@ -318,6 +326,14 @@ This package contains the development files for Ghostscript.
# see https://bugs.ghostscript.com/show_bug.cgi?id=707051 # see https://bugs.ghostscript.com/show_bug.cgi?id=707051
# and https://bugzilla.suse.com/show_bug.cgi?id=1215466 # and https://bugzilla.suse.com/show_bug.cgi?id=1215466
%patch105 %patch105
# Patch106 CVE-2023-46751.patch is
# https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13
# adapted for Ghostscript-9.56.1 that fixes
# https://bugs.ghostscript.com/show_bug.cgi?id=707264
# which includes a fix for CVE-2023-46751
# "dangling pointer in gdev_prn_open_printer_seekable()"
# see https://bugzilla.suse.com/show_bug.cgi?id=1217871
%patch106
# Remove patch backup files to avoid packaging # Remove patch backup files to avoid packaging
# cf. https://build.opensuse.org/request/show/581052 # cf. https://build.opensuse.org/request/show/581052
rm -f Resource/Init/*.ps.orig rm -f Resource/Init/*.ps.orig