diff options
| author | Peter Korsgaard <peter@korsgaard.com> | 2018-11-29 16:50:49 +0100 |
|---|---|---|
| committer | Peter Korsgaard <peter@korsgaard.com> | 2018-11-29 19:57:09 +0100 |
| commit | e52b02677a2b207e89092bcd67a1c03450a26f66 (patch) | |
| tree | f26ebffac545c69c27438ab442814932640ca08a /package/ghostscript/ghostscript.mk | |
| parent | 1514da371f83ddc3345d688671f1a1c36bb74594 (diff) | |
| download | buildroot-e52b02677a2b207e89092bcd67a1c03450a26f66.tar.gz buildroot-e52b02677a2b207e89092bcd67a1c03450a26f66.zip | |
ghostscript: security bump to version 9.26
Fixes the following security vulnerabilities:
- CVE-2018-17961: Artifex Ghostscript 9.25 and earlier allows attackers to
bypass a sandbox protection mechanism via vectors involving errorhandler
setup. NOTE: this issue exists because of an incomplete fix for
CVE-2018-17183.
- CVE-2018-18284: Artifex Ghostscript 9.25 and earlier allows attackers to
bypass a sandbox protection mechanism via vectors involving the 1Policy
operator.
- CVE-2018-19409: An issue was discovered in Artifex Ghostscript before
9.26. LockSafetyParams is not checked correctly if another device is
used.
- CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows
remote attackers to bypass intended access restrictions because available
stack space is not checked when the device remains the same.
- CVE-2018-19476: psi/zicc.c in Artifex Ghostscript before 9.26 allows
remote attackers to bypass intended access restrictions because of a
setcolorspace type confusion.
- CVE-2018-19477: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows
remote attackers to bypass intended access restrictions because of a
JBIG2Decode type confusion.
For more details, see the release notes:
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Diffstat (limited to 'package/ghostscript/ghostscript.mk')
| -rw-r--r-- | package/ghostscript/ghostscript.mk | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/package/ghostscript/ghostscript.mk b/package/ghostscript/ghostscript.mk index b1f5e1edb1..357fd08c32 100644 --- a/package/ghostscript/ghostscript.mk +++ b/package/ghostscript/ghostscript.mk @@ -4,8 +4,8 @@ # ################################################################################ -GHOSTSCRIPT_VERSION = 9.25 -GHOSTSCRIPT_SITE = https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs925 +GHOSTSCRIPT_VERSION = 9.26 +GHOSTSCRIPT_SITE = https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs926 GHOSTSCRIPT_SOURCE = ghostscript-$(GHOSTSCRIPT_VERSION).tar.xz GHOSTSCRIPT_LICENSE = AGPL-3.0 GHOSTSCRIPT_LICENSE_FILES = LICENSE |
