Accepting request 652826 from home:jsmeix:branches:Printing
Version upgrade to 9.26 (Purely security and a few bug fixes) OBS-URL: https://build.opensuse.org/request/show/652826 OBS-URL: https://build.opensuse.org/package/show/Printing/ghostscript?expand=0&rev=99
This commit is contained in:
Johannes Meixner
Git OBS Bridge
parent
98164e5415
commit
f0089d8f2b
@ -1,5 +1,5 @@
|
|||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Wed Nov 21 12:37:13 CET 2018 - jsmeix@suse.de
|
Fri Nov 30 09:01:17 CET 2018 - jsmeix@suse.de
|
||||||
|
|
||||||
- Version upgrade to 9.26
|
- Version upgrade to 9.26
|
||||||
Highlights in this release include:
|
Highlights in this release include:
|
||||||
@ -18,6 +18,42 @@ Wed Nov 21 12:37:13 CET 2018 - jsmeix@suse.de
|
|||||||
For a release summary see:
|
For a release summary see:
|
||||||
http://www.ghostscript.com/doc/9.26/News.htm
|
http://www.ghostscript.com/doc/9.26/News.htm
|
||||||
For details see the News.htm and History9.htm files.
|
For details see the News.htm and History9.htm files.
|
||||||
|
The Ghostscript 9.26 release should fix (cf. the entry below
|
||||||
|
dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
|
||||||
|
in particular those security issues (bsc#1117331)
|
||||||
|
* CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
|
||||||
|
intended access restrictions
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700153
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
|
||||||
|
* CVE-2018-19476: psi/zicc.c allows attackers to bypass
|
||||||
|
intended access restrictions because of a setcolorspace
|
||||||
|
type confusion
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700169
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
|
||||||
|
* CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
|
||||||
|
intended access restrictions because of a JBIG2Decode
|
||||||
|
type confusion
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700168
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
|
||||||
|
* CVE-2018-19409: LockSafetyParams is not checked correctly
|
||||||
|
if another device is used
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700176
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
|
||||||
|
and those security issues
|
||||||
|
* CVE-2018-18284: 1Policy operator gives access to .forceput
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=69963
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
|
||||||
|
* CVE-2018-18073: saved execution stacks can leak operator arrays
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699927
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
|
||||||
|
* CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699816
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
|
||||||
|
* CVE-2018-17183: remote attackers could be able to supply
|
||||||
|
crafted PostScript to potentially overwrite or replace
|
||||||
|
error handlers to inject code
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699708
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Nov 9 11:25:19 CET 2018 - jsmeix@suse.de
|
Fri Nov 9 11:25:19 CET 2018 - jsmeix@suse.de
|
||||||
|
|||||||
@ -1,5 +1,5 @@
|
|||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Wed Nov 21 12:37:13 CET 2018 - jsmeix@suse.de
|
Fri Nov 30 09:01:17 CET 2018 - jsmeix@suse.de
|
||||||
|
|
||||||
- Version upgrade to 9.26
|
- Version upgrade to 9.26
|
||||||
Highlights in this release include:
|
Highlights in this release include:
|
||||||
@ -18,6 +18,42 @@ Wed Nov 21 12:37:13 CET 2018 - jsmeix@suse.de
|
|||||||
For a release summary see:
|
For a release summary see:
|
||||||
http://www.ghostscript.com/doc/9.26/News.htm
|
http://www.ghostscript.com/doc/9.26/News.htm
|
||||||
For details see the News.htm and History9.htm files.
|
For details see the News.htm and History9.htm files.
|
||||||
|
The Ghostscript 9.26 release should fix (cf. the entry below
|
||||||
|
dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
|
||||||
|
in particular those security issues (bsc#1117331)
|
||||||
|
* CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
|
||||||
|
intended access restrictions
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700153
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
|
||||||
|
* CVE-2018-19476: psi/zicc.c allows attackers to bypass
|
||||||
|
intended access restrictions because of a setcolorspace
|
||||||
|
type confusion
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700169
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
|
||||||
|
* CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
|
||||||
|
intended access restrictions because of a JBIG2Decode
|
||||||
|
type confusion
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700168
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
|
||||||
|
* CVE-2018-19409: LockSafetyParams is not checked correctly
|
||||||
|
if another device is used
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=700176
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
|
||||||
|
and those security issues
|
||||||
|
* CVE-2018-18284: 1Policy operator gives access to .forceput
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=69963
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
|
||||||
|
* CVE-2018-18073: saved execution stacks can leak operator arrays
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699927
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
|
||||||
|
* CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699816
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
|
||||||
|
* CVE-2018-17183: remote attackers could be able to supply
|
||||||
|
crafted PostScript to potentially overwrite or replace
|
||||||
|
error handlers to inject code
|
||||||
|
https://bugs.ghostscript.com/show_bug.cgi?id=699708
|
||||||
|
https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105
|
||||||
|
|
||||||
-------------------------------------------------------------------
|
-------------------------------------------------------------------
|
||||||
Fri Nov 9 11:25:19 CET 2018 - jsmeix@suse.de
|
Fri Nov 9 11:25:19 CET 2018 - jsmeix@suse.de
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user