buildroot/package/ghostscript, branch 2019.02-op-build

package/ghostscript: add upstream security fixes

2019-02-12T19:02:46+00:00

CVE-2019-6116: Remote code execution. https://www.openwall.com/lists/oss-security/2019/01/23/5 Cc: Bernd Kuhls Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

ghostscript: security bump to version 9.26

2018-11-29T18:57:09+00:00

Fixes the following security vulnerabilities: - CVE-2018-17961: Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. - CVE-2018-18284: Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. - CVE-2018-19409: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. - CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. - CVE-2018-19476: psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion. - CVE-2018-19477: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion. For more details, see the release notes: https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26 Signed-off-by: Peter Korsgaard

package/ghostscript: fix removal of included lcms2

2018-10-03T07:38:34+00:00

Ghostscript 9.24 changed the internal lcms2 version: https://www.ghostscript.com/doc/9.24/News.htm With this change the directory name was also changed which broke our code to force the usage of the buildroot lcms2 package. Fixes http://autobuild.buildroot.net/results/d04/d04ad017bf06a442a7397f935959994ba72824e1/ Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard

ghostscript: security bump to version 9.25

2018-09-28T13:07:45+00:00

Fixes the following security issues: - CVE-2018-16543: In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact - CVE-2018-17183: Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code. Signed-off-by: Peter Korsgaard

ghostscript: set correct font path on target

2018-07-28T21:57:10+00:00

GHOSTSCRIPT_FONTS_TARGET_DIR is set to $(TARGET_DIR)/usr/share/fonts/gs in ghostscript-fonts.mk. If we pass this full path to ghostscript, it will look for fonts in $(TARGET_DIR), which doesn't exist on the target. Instead of /usr/share/fonts/gs, use /usr/share/fonts so ghostscript can also access other fonts than the ones installed by ghostscript-fonts. Signed-off-by: Thomas Ehrhardt Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

ghostscript: don't use lcms2art

2018-05-06T07:05:03+00:00

Delete lcsm2art directory to use the buildroot lcms2 library Fixes: - http://autobuild.buildroot.net/results/cda9c22bf29278cc24ab852094df19b773d0f151 Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard

ghostscript: bump to version 9.23

2018-05-03T20:07:23+00:00

- Remove sha256 (not provided anymore) and keep only sha512 - Update patch - Add hash for license file Signed-off-by: Fabrice Fontaine Signed-off-by: Thomas Petazzoni

ghostscript: bump version to 9.22

2017-10-17T20:36:20+00:00

Remove patches that has been merged/updated upstream 0002-Host-tool-mkromfs_1-needs-libz.patch -> http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=284f5fe121d8eb0a0f50a6f2465ee2f99a061018 0003-Bug-697799-have-.eqproc-check-its-parameters.patch -> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719e1cfaea77b67cb26e26de7fe4d7f9b2e http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad 0004-Bug-697799-have-.rsdparams-check-its-parameters -> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce174eed24edec7ad5b920eb93db4d47d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad Signed-off-by: Olivier Schonken Signed-off-by: Thomas Petazzoni

ghostscript: add upstream security fixes for CVE-2017-8291

2017-04-28T12:15:32+00:00

CVE-2017-8291 - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. For more details, see https://bugzilla.suse.com/show_bug.cgi?id=1036453 Signed-off-by: Peter Korsgaard

package: use SPDX short identifier for AGPLv3

2017-04-01T13:18:47+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for AGPLv3 is AGPL-3.0. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/AGPLv3/AGPL-3.0/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni