summaryrefslogtreecommitdiffstats
path: root/package/ghostscript
Commit message (Collapse)AuthorAgeFilesLines
* ghostscript: security bump to version 9.26Peter Korsgaard2018-11-292-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security vulnerabilities: - CVE-2018-17961: Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. - CVE-2018-18284: Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. - CVE-2018-19409: An issue was discovered in Artifex Ghostscript before 9.26. LockSafetyParams is not checked correctly if another device is used. - CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same. - CVE-2018-19476: psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion. - CVE-2018-19477: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion. For more details, see the release notes: https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/ghostscript: fix removal of included lcms2Bernd Kuhls2018-10-031-2/+2
| | | | | | | | | | | | | | Ghostscript 9.24 changed the internal lcms2 version: https://www.ghostscript.com/doc/9.24/News.htm With this change the directory name was also changed which broke our code to force the usage of the buildroot lcms2 package. Fixes http://autobuild.buildroot.net/results/d04/d04ad017bf06a442a7397f935959994ba72824e1/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ghostscript: security bump to version 9.25Peter Korsgaard2018-09-282-4/+4
| | | | | | | | | | | | | | Fixes the following security issues: - CVE-2018-16543: In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact - CVE-2018-17183: Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite or replace error handlers to inject code. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ghostscript: set correct font path on targetThomas Ehrhardt2018-07-281-1/+1
| | | | | | | | | | | | | GHOSTSCRIPT_FONTS_TARGET_DIR is set to $(TARGET_DIR)/usr/share/fonts/gs in ghostscript-fonts.mk. If we pass this full path to ghostscript, it will look for fonts in $(TARGET_DIR), which doesn't exist on the target. Instead of /usr/share/fonts/gs, use /usr/share/fonts so ghostscript can also access other fonts than the ones installed by ghostscript-fonts. Signed-off-by: Thomas Ehrhardt <tehrhardt@innovaphone.com> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
* ghostscript: don't use lcms2artFabrice Fontaine2018-05-061-1/+2
| | | | | | | | | | Delete lcsm2art directory to use the buildroot lcms2 library Fixes: - http://autobuild.buildroot.net/results/cda9c22bf29278cc24ab852094df19b773d0f151 Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* ghostscript: bump to version 9.23Fabrice Fontaine2018-05-033-6/+11
| | | | | | | | | - Remove sha256 (not provided anymore) and keep only sha512 - Update patch - Add hash for license file Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
* ghostscript: bump version to 9.22Olivier Schonken2017-10-175-149/+6
| | | | | | | | | | | | | | | | | Remove patches that has been merged/updated upstream 0002-Host-tool-mkromfs_1-needs-libz.patch -> http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=284f5fe121d8eb0a0f50a6f2465ee2f99a061018 0003-Bug-697799-have-.eqproc-check-its-parameters.patch -> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719e1cfaea77b67cb26e26de7fe4d7f9b2e http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad 0004-Bug-697799-have-.rsdparams-check-its-parameters -> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce174eed24edec7ad5b920eb93db4d47d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* ghostscript: add upstream security fixes for CVE-2017-8291Peter Korsgaard2017-04-282-0/+95
| | | | | | | | | | | CVE-2017-8291 - Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. For more details, see https://bugzilla.suse.com/show_bug.cgi?id=1036453 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: use SPDX short identifier for AGPLv3Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | We want to use SPDX identifier for license string as much as possible. SPDX short identifier for AGPLv3 is AGPL-3.0. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/AGPLv3/AGPL-3.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* ghostscript: needs host-zlibRodrigo Rebello2017-03-261-1/+2
| | | | | | | | | | | | | | | | | | The ghostscript configure script checks for zlib on the host when configuring the build of auxiliary programs used in the compilation process and fails if such library is not found. Add 'host-zlib' as a dependency and, while at it, also enclose $(HOSTCC) in double quotes, otherwise configure fails when that variable expands to a command containing spaces (e.g. when ccache is enabled). Fixes: http://autobuild.buildroot.net/results/61af9caa7fe6fce6b11f78f66b9d3590f37e92e7/ http://autobuild.buildroot.net/results/904f06e14247c22f740d8fd8902618017e0518f6/ Signed-off-by: Rodrigo Rebello <rprebello@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* ghostscript: drop the ijs subfolder to fix buildThomas Petazzoni2017-03-211-1/+1
| | | | | | | | | | | | | | | | | | | | | The ijs/ subfolder contains a bogus ltmain.sh file, which is actually a broken symbolic link. Due to this, our logic to patch ltmain.sh files fail with some patch versions: >>> ghostscript 9.21 Patching libtool File /home/buildroot/build/instance-0/output/build/ghostscript-9.21/ijs/ltmain.sh is not a regular file -- refusing to patch Since we are anyway not using the ijs support (--without-ijs is passed), do like we do for all other sub-components of ghostscript: get rid of the ijs/ subfolder completely. Fixes: http://autobuild.buildroot.net/results/ca683d69b7fb564788c8877c3bb6466390e976a8/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/ghostscript: new packageBernd Kuhls2017-03-205-0/+160
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> [Thomas: - switch to version 9.21 now that it has been released - add a hash file - switch to Git formatted patches - use $(HOSTCC) instead of hardcoding "gcc", and use $(HOST_CFLAGS) and $(HOST_LDFLAGS) instead of hardcoding -L$(HOST_DIR)/usr/lib -I$(HOST_DIR)/usr/include - add entry to DEVELOPERS file.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
OpenPOWER on IntegriCloud