Change log for ghostscript package in Ubuntu
1 → 75 of 406 results | First • Previous • Next • Last |
ghostscript (10.03.1~dfsg1-0ubuntu2) oracular; urgency=low * Do not compile with Neon FPU support on 32-bit ARM (see also Debian bug #1012254). Otherwise we get FTBFS on armhf. -- Till Kamppeter <email address hidden> Mon, 12 Aug 2024 00:00:01 +0200
Available diffs
Superseded in oracular-proposed |
ghostscript (10.03.1~dfsg1-0ubuntu1) oracular; urgency=low * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.03.1, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support. * Drop CVE* patches, included upstream. -- Till Kamppeter <email address hidden> Thu, 10 Aug 2024 20:46:21 +0200
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.9) jammy-security; urgency=medium * SECURITY UPDATE: stack-based buffer overflow via long PDF filter name - debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad Filters to overflow the debug buffer in pdf/pdf_file.c. - CVE-2024-29506 * SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont name - debian/patches/CVE-2024-29508.patch: review printing of pointers in base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c, base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c, devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c, psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c. - debian/patches/CVE-2024-29508-2.patch: remove extra arguments in devices/gdevupd.c. - CVE-2024-29508 * SECURITY UPDATE: heap-based overflow via PDFPassword with null byte - debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in pdf/pdf_sec.c. - CVE-2024-29509 * SECURITY UPDATE: directory traversal issue via OCRLanguage - debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdfp.c. - debian/patches/CVE-2024-29511-2.patch: original fix was overly aggressive in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c. - debian/libgs9.symbols: mark some symbols as optional. - CVE-2024-29511 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:07:09 -0400
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu9) oracular; urgency=medium * debian/patches/CVE-2024-29511-2.patch: original fix was overly aggressive in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c. -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:25:28 -0400
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu7.3) noble-security; urgency=medium * SECURITY UPDATE: stack-based buffer overflow via long PDF filter name - debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad Filters to overflow the debug buffer in pdf/pdf_file.c. - CVE-2024-29506 * SECURITY UPDATE: stack-based buffer overflows - debian/patches/CVE-2024-29507.patch: bounds checks when using CIDFont related params in pdf/pdf_font.c, pdf/pdf_warnings.h. - CVE-2024-29507 * SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont name - debian/patches/CVE-2024-29508.patch: review printing of pointers in base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c, base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c, devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c, psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c. - debian/patches/CVE-2024-29508-2.patch: fix compiler warning in optimised build in base/gsicc_cache.c. - debian/patches/CVE-2024-29508-3.patch: remove extra arguments in devices/gdevupd.c. - CVE-2024-29508 * SECURITY UPDATE: heap-based overflow via PDFPassword with null byte - debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in pdf/pdf_sec.c. - CVE-2024-29509 * SECURITY UPDATE: directory traversal issue via OCRLanguage - debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdfp.c. - debian/patches/CVE-2024-29511-2.patch: original fix was overly aggressive in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c. - CVE-2024-29511 -- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:07:09 -0400
Available diffs
Superseded in oracular-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu8) oracular; urgency=medium [ Marc Deslauriers } * SECURITY UPDATE: stack-based buffer overflow via long PDF filter name - debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad Filters to overflow the debug buffer in pdf/pdf_file.c. - CVE-2024-29506 * SECURITY UPDATE: stack-based buffer overflows - debian/patches/CVE-2024-29507.patch: bounds checks when using CIDFont related params in pdf/pdf_font.c, pdf/pdf_warnings.h. - CVE-2024-29507 * SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont name - debian/patches/CVE-2024-29508.patch: review printing of pointers in base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c, base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c, devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c, psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c. - debian/patches/CVE-2024-29508-2.patch: fix compiler warning in optimised build in base/gsicc_cache.c. - debian/patches/CVE-2024-29508-3.patch: remove extra arguments in devices/gdevupd.c. - CVE-2024-29508 * SECURITY UPDATE: heap-based overflow via PDFPassword with null byte - debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in pdf/pdf_sec.c. - CVE-2024-29509 * SECURITY UPDATE: directory traversal issue via OCRLanguage - debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c, devices/vector/gdevpdfp.c. - CVE-2024-29511 [ Chris Kim ] * SECURITY UPDATE: Arbitrary code execution via uniprint device - debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device argument strings after SAFER is activated in gdevupd.c. - CVE-2024-29510 * SECURITY UPDATE: Path traversal and arbitrary code execution via improperly checked path arguments - debian/patches/CVE-2024-33869-part1.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - debian/patches/CVE-2024-33869-part2.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - CVE-2024-33869 * SECURITY UPDATE: Path traversal via improperly checked path arguments - debian/patches/CVE-2024-33870.patch: Add a check for parent directory prefixes when handling relative paths in gpmisc.c. - CVE-2024-33870 * SECURITY UPDATE: Arbitrary code execution via custom driver library - debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that specifies the names of dynamic libraries to be loaded by the opvp/oprp device in gdevopvp.c - CVE-2024-33871 -- Marc Deslauriers <email address hidden> Wed, 10 Jul 2024 13:28:20 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.13) focal-security; urgency=medium * SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont name - debian/patches/CVE-2024-29508.patch: review printing of pointers in base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c, base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c, devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c, psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c. - debian/patches/CVE-2024-29508-2.patch: remove extra arguments in devices/gdevupd.c. - CVE-2024-29508 -- Marc Deslauriers <email address hidden> Wed, 10 Jul 2024 09:40:58 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.12) focal-security; urgency=medium * SECURITY UPDATE: Policy bypass via improperly checked eexec seed - debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than Type 1 standard when SAFER mode is used in zmisc1.c. - CVE-2023-52722 * SECURITY UPDATE: Arbitrary code execution via uniprint device - debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device argument strings after SAFER is activated in gdevupd.c. - CVE-2024-29510 * SECURITY UPDATE: Path traversal and arbitrary code execution via improperly checked path arguments - debian/patches/CVE-2024-33869-part1.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - debian/patches/CVE-2024-33869-part2.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - CVE-2024-33869 * SECURITY UPDATE: Path traversal via improperly checked path arguments - debian/patches/CVE-2024-33870.patch: Add a check for parent directory prefixes when handling relative paths in gpmisc.c. - CVE-2024-33870 * SECURITY UPDATE: Arbitrary code execution via custom driver library - debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that specifies the names of dynamic libraries to be loaded by the opvp/oprp device in gdevopvp.c - CVE-2024-33871 -- Chris Kim <email address hidden> Tue, 04 Jun 2024 08:30:59 -0700
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.7) jammy-security; urgency=medium * SECURITY UPDATE: Policy bypass via improperly checked eexec seed - debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than Type 1 standard when SAFER mode is used in zmisc1.c. - CVE-2023-52722 * SECURITY UPDATE: Arbitrary code execution via uniprint device - debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device argument strings after SAFER is activated in gdevupd.c. - CVE-2024-29510 * SECURITY UPDATE: Path traversal and arbitrary code execution via improperly checked path arguments - debian/patches/CVE-2024-33869-part1.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - debian/patches/CVE-2024-33869-part2.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - CVE-2024-33869 * SECURITY UPDATE: Path traversal via improperly checked path arguments - debian/patches/CVE-2024-33870.patch: Add a check for parent directory prefixes when handling relative paths in gpmisc.c. - CVE-2024-33870 * SECURITY UPDATE: Arbitrary code execution via custom driver library - debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that specifies the names of dynamic libraries to be loaded by the opvp/oprp device in gdevopvp.c - CVE-2024-33871 -- Chris Kim <email address hidden> Mon, 03 Jun 2024 21:54:57 -0700
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu2.3) mantic-security; urgency=medium * SECURITY UPDATE: Policy bypass via improperly checked eexec seed - debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than Type 1 standard when SAFER mode is used in zmisc1.c. - CVE-2023-52722 * SECURITY UPDATE: Arbitrary code execution via uniprint device - debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device argument strings after SAFER is activated in gdevupd.c. - CVE-2024-29510 * SECURITY UPDATE: Path traversal and arbitrary code execution via improperly checked path arguments - debian/patches/CVE-2024-33869-part1.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - debian/patches/CVE-2024-33869-part2.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - CVE-2024-33869 * SECURITY UPDATE: Path traversal via improperly checked path arguments - debian/patches/CVE-2024-33870.patch: Add a check for parent directory prefixes when handling relative paths in gpmisc.c. - CVE-2024-33870 * SECURITY UPDATE: Arbitrary code execution via custom driver library - debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that specifies the names of dynamic libraries to be loaded by the opvp/oprp device in gdevopvp.c - CVE-2024-33871 -- Chris Kim <email address hidden> Mon, 03 Jun 2024 14:47:09 -0700
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu7.1) noble-security; urgency=medium * SECURITY UPDATE: Arbitrary code execution via uniprint device - debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device argument strings after SAFER is activated in gdevupd.c. - CVE-2024-29510 * SECURITY UPDATE: Path traversal and arbitrary code execution via improperly checked path arguments - debian/patches/CVE-2024-33869-part1.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - debian/patches/CVE-2024-33869-part2.patch: Check that a current working directory specifier is valid before stripping it from gpmisc.c. - CVE-2024-33869 * SECURITY UPDATE: Path traversal via improperly checked path arguments - debian/patches/CVE-2024-33870.patch: Add a check for parent directory prefixes when handling relative paths in gpmisc.c. - CVE-2024-33870 * SECURITY UPDATE: Arbitrary code execution via custom driver library - debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that specifies the names of dynamic libraries to be loaded by the opvp/oprp device in gdevopvp.c - CVE-2024-33871 -- Chris Kim <email address hidden> Wed, 05 Jun 2024 10:32:38 -0700
Available diffs
Superseded in oracular-release |
Published in noble-release |
Deleted in noble-proposed (Reason: Moved to noble) |
ghostscript (10.02.1~dfsg1-0ubuntu7) noble; urgency=high * No change rebuild against libcups2t64, libpng16-16t64, libxt6t64. -- Julian Andres Klode <email address hidden> Mon, 08 Apr 2024 16:39:44 +0200
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu6) noble; urgency=medium * No-change rebuild for CVE-2024-3094 -- Steve Langasek <email address hidden> Sat, 30 Mar 2024 23:49:24 +0000
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu5) noble; urgency=medium * No-change rebuild against libcups2t64. -- Michael Hudson-Doyle <email address hidden> Wed, 20 Mar 2024 13:48:31 +1300
Available diffs
Superseded in noble-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu4) noble; urgency=medium * No-change rebuild against libxt6t64 -- Steve Langasek <email address hidden> Sat, 09 Mar 2024 00:49:00 +0000
Superseded in noble-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu3) noble; urgency=medium * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.02.1, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support. [ наб ] * [ee3d1ac] Simplify /sbin/update-gsfontmap (Closes: #992889) [ Steve Robbins ] * [ccc0e3c] Explicitly set font map files to be world readable. Closes: #740959. * [5fce3d3] Add suggestion for package texlive-binaries, needed to use dvipdf. Closes: #782901. * [9ab8028] ghostscript: add conflicts to ghostcript-x to allow removal of the obsolete transitional package. Closes: #1053377 -- Till Kamppeter <email address hidden> Thu, 29 Feb 2024 01:30:05 +0100
Available diffs
Deleted in noble-updates (Reason: superseded by release) |
Superseded in noble-release |
Deleted in noble-proposed (Reason: Moved to noble) |
ghostscript (10.02.1~dfsg1-0ubuntu2) noble; urgency=medium * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.02.1, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support. [ Steve Robbins ] * [4b077b5] Incorporate upstream patch to fix PageList processing in PDF handler. Closes: #1052652 * [b4524f9] New maintainer. Closes: #1022718, #1036869. -- Till Kamppeter <email address hidden> Sat, 06 Jan 2024 19:16:05 -0300
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.6) jammy-security; urgency=medium * SECURITY UPDATE: DoS via dangling pointer - debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for seekable output files in base/gdevprn.c, devices/gdevtsep.c. - CVE-2023-46751 -- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:25:45 -0500
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu2.2) mantic-security; urgency=medium * SECURITY UPDATE: DoS via dangling pointer - debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for seekable output files in base/gdevprn.c, devices/gdevtsep.c. - CVE-2023-46751 -- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:22:28 -0500
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.5) lunar-security; urgency=medium * SECURITY UPDATE: DoS via dangling pointer - debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for seekable output files in base/gdevprn.c, devices/gdevtsep.c. - CVE-2023-46751 -- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:25:02 -0500
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu1) noble; urgency=medium * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.02.1, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support. * Drop CVE* patches, included upstream. -- Till Kamppeter <email address hidden> Thu, 07 Dec 2023 19:05:05 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.5) jammy-security; urgency=medium * SECURITY UPDATE: code execution via PS documents and IJS device - debian/patches/CVE-2023-43115.patch: prevent PostScript programs switching to the IJS device after SAFER has been activated in devices/gdevijs.c. - CVE-2023-43115 -- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:02:58 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.11) focal-security; urgency=medium * SECURITY UPDATE: code execution via PS documents and IJS device - debian/patches/CVE-2023-43115.patch: prevent PostScript programs switching to the IJS device after SAFER has been activated in devices/gdevijs.c. - CVE-2023-43115 -- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:06:46 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.4) lunar-security; urgency=medium * SECURITY UPDATE: code execution via PS documents and IJS device - debian/patches/CVE-2023-43115.patch: prevent PostScript programs switching to the IJS device after SAFER has been activated in devices/gdevijs.c. - CVE-2023-43115 -- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:02:25 -0400
Available diffs
Superseded in noble-release |
Deleted in noble-proposed (Reason: Moved to noble) |
Superseded in noble-proposed |
Superseded in mantic-updates |
Superseded in mantic-security |
ghostscript (10.01.2~dfsg1-0ubuntu2.1) mantic-security; urgency=medium * SECURITY UPDATE: code execution via PS documents and IJS device - debian/patches/CVE-2023-43115.patch: prevent PostScript programs switching to the IJS device after SAFER has been activated in devices/gdevijs.c. - CVE-2023-43115 -- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 08:59:19 -0400
Available diffs
- diff from 10.01.2~dfsg1-0ubuntu2 (in Ubuntu) to 10.01.2~dfsg1-0ubuntu2.1 (1.7 KiB)
- diff from 10.0.0~dfsg1-0ubuntu3 to 10.01.2~dfsg1-0ubuntu2.1 (pending)
Superseded in noble-release |
Published in mantic-release |
Deleted in mantic-proposed (Reason: Moved to mantic) |
ghostscript (10.01.2~dfsg1-0ubuntu2) mantic; urgency=medium * SECURITY UPDATE: buffer overflow - debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c. - CVE-2023-38559 -- Allen Huang <email address hidden> Thu, 21 Sep 2023 17:06:57 +0200
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.10) focal-security; urgency=medium * SECURITY UPDATE: Divide By Zero - debian/patches/CVE-2020-21710-1.patch: add a zero check for bytes_per_space before using it for division in eps_print_page() in devices/gdevepsn.c. - debian/patches/CVE-2020-21710-2.patch: add a zero check for bytes_per_space before using it for division in epsc_print_page() in devices/gdevepsc.c - CVE-2020-21710 * SECURITY UPDATE: Out-of-Bounds Write - debian/patches/CVE-2020-21890-pre.patch: add the float res assignment in clj_get_params() in devices/gdevclj.c. - debian/patches/CVE-2020-21890.patch: change the variable for division to use res instead of fres.data that could be uninitialized, in clj_media_size() in devices/gdevclj.c. - CVE-2020-21890 -- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 12 Sep 2023 11:40:34 -0300
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu1) mantic; urgency=low * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.00.0, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support.
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.3) lunar-security; urgency=medium * SECURITY UPDATE: buffer overflow - debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c. - CVE-2023-38559 -- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:25:30 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.4) jammy-security; urgency=medium * SECURITY UPDATE: buffer overflow - debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c. - CVE-2023-38559 -- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:40:49 +0100
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.9) focal-security; urgency=medium * SECURITY UPDATE: buffer overflow - debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c. - CVE-2023-38559 -- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:17:37 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.3) jammy-security; urgency=medium * SECURITY UPDATE: incorrect permission validation for pipe devices - debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names for permission validation in base/gpmisc.c, base/gslibctx.c. - debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test in base/gpmisc.c, base/gslibctx.c. - CVE-2023-36664 -- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:49:52 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu2) mantic; urgency=medium * SECURITY UPDATE: incorrect permission validation for pipe devices - debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names for permission validation in base/gpmisc.c, base/gslibctx.c. - debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test in base/gpmisc.c, base/gslibctx.c. - CVE-2023-36664 -- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:45:07 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.2) lunar-security; urgency=medium * SECURITY UPDATE: incorrect permission validation for pipe devices - debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names for permission validation in base/gpmisc.c, base/gslibctx.c. - debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test in base/gpmisc.c, base/gslibctx.c. - CVE-2023-36664 -- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:45:07 -0400
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu3.2) kinetic-security; urgency=medium * SECURITY UPDATE: incorrect permission validation for pipe devices - debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names for permission validation in base/gpmisc.c, base/gslibctx.c. - debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test in base/gpmisc.c, base/gslibctx.c. - CVE-2023-36664 -- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:49:15 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.8) focal-security; urgency=medium * SECURITY UPDATE: incorrect permission validation for pipe devices - debian/patches/CVE-2023-36664-pre1.patch: improve handling of current directory permissions in base/gpmisc.c. - debian/patches/CVE-2023-36664-pre2.patch: fix gp_file allocations to use thread_safe_memory in base/gpmisc.c. - debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names for permission validation in base/gpmisc.c, base/gslibctx.c. - debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test in base/gpmisc.c, base/gslibctx.c. - CVE-2023-36664 -- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:56:27 -0400
Available diffs
Superseded in mantic-release |
Deleted in mantic-proposed (Reason: Moved to mantic) |
Superseded in lunar-updates |
Superseded in lunar-security |
ghostscript (10.0.0~dfsg1-0ubuntu1.1) lunar-security; urgency=medium * SECURITY UPDATE: Buffer Overflow - debian/patches/CVE-2023-28879.patch: add check to make sure that the buffer has space for two characters in s_xBCPE_process() in base/sbcp.c. - debian/patches/CVE-2023-28879-post.patch: add PostScript filters removals in Resource/Init/gs_init.ps. - CVE-2023-28879 -- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 25 Apr 2023 16:29:39 -0300
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu3.1) kinetic-security; urgency=medium * SECURITY UPDATE: Buffer Overflow - debian/patches/CVE-2023-28879.patch: add check to make sure that the buffer has space for two characters in s_xBCPE_process() in base/sbcp.c. - debian/patches/CVE-2023-28879-post.patch: add PostScript filters removals in Resource/Init/gs_init.ps. - CVE-2023-28879 -- Rodrigo Figueiredo Zaiden <email address hidden> Wed, 12 Apr 2023 21:24:02 -0300
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.2) jammy-security; urgency=medium * SECURITY UPDATE: Buffer Overflow - debian/patches/CVE-2023-28879.patch: add check to make sure that the buffer has space for two characters in s_xBCPE_process() in base/sbcp.c. - CVE-2023-28879 -- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 11:15:40 -0300
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.7) focal-security; urgency=medium * SECURITY UPDATE: Buffer Overflow - debian/patches/CVE-2023-28879.patch: add check to make sure that the buffer has space for two characters in s_xBCPE_process() in base/sbcp.c. - CVE-2023-28879 -- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 10:48:39 -0300
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.18) bionic-security; urgency=medium * SECURITY UPDATE: Buffer Overflow - debian/patches/CVE-2023-28879.patch: add check to make sure that the buffer has space for two characters in s_xBCPE_process() in base/sbcp.c. - CVE-2023-28879 -- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 10:09:22 -0300
Available diffs
Superseded in mantic-release |
Published in lunar-release |
Deleted in lunar-proposed (Reason: Moved to lunar) |
ghostscript (10.0.0~dfsg1-0ubuntu1) lunar; urgency=low * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 10.00.0, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Just mark all libtesseract symbols optional and be done with it. They are also arch-specific so causing build failures on non-x86. - Also keep the lcms2mt convenience copy as it is heavily patched by Ghostscript's upstream developers, especially for multi-threading (mt) support. - Upstream patch (commit 387f094) for the CUPS/PWG/Apple Raster output device not to match custom page sizes against the sizes defined in the PPD file, to avoid unwished rotations or size adjustments. (cups-filters upstream issue #484).
Available diffs
Superseded in lunar-proposed |
ghostscript (9.56.1~dfsg1-0ubuntu4) lunar; urgency=medium * Rebuild against latest tiff -- Jeremy Bicha <email address hidden> Sat, 04 Feb 2023 15:24:23 -0500
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.6) focal-security; urgency=medium * SECURITY UPDATE: heap-based buffer overflow in lp8000_print_page() - debian/patches/CVE-2020-27792.patch: fixed output buffer size worst case in devices/gdevlp8k.c. - CVE-2020-27792 -- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:40:09 -0400
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.17) bionic-security; urgency=medium * SECURITY UPDATE: heap-based buffer overflow in lp8000_print_page() - debian/patches/CVE-2020-27792.patch: fixed output buffer size worst case in devices/gdevlp8k.c. - CVE-2020-27792 -- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:43:27 -0400
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.1) jammy-security; urgency=medium * SECURITY UPDATE: NULL pointer dereference issue - debian/patches/CVE-2022-2085.patch: add init_device_procs entry for mem_x_device in base/gdevmx.c. - CVE-2022-2085 -- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:05:05 -0400
Superseded in lunar-release |
Obsolete in kinetic-release |
Deleted in kinetic-proposed (Reason: Moved to kinetic) |
ghostscript (9.56.1~dfsg1-0ubuntu3) kinetic; urgency=low * Added upstream patch (commit 387f094) for the CUPS/PWG/Apple Raster output device not to match custom page sizes against the sizes defined in the PPD file, to avoid unwished rotations or size adjustments. (cups-filters upstream issue #484). -- Till Kamppeter <email address hidden> Sun, 25 Sep 2022 10:26:00 +0200
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu2) kinetic; urgency=low * Added upstream patch (commit 2a54c67) to use stable memory for pdfi streams, to avoid double-free when "runpdfend" when done with a PDF interpreter started with "runpdfbegin". This caused the autopkgtest of xfig to fail (Upstream bugs #705855, #705836, #705210). -- Till Kamppeter <email address hidden> Thu, 08 Sep 2022 13:00:00 +0200
Available diffs
Superseded in kinetic-proposed |
ghostscript (9.56.1~dfsg1-0ubuntu1) kinetic; urgency=low * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 9.56.1, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Just mark all libtesseract symbols optional and be done with it. They are also arch-specific so causing build failures on non-x86. * Added upstream patch (commit 1f876cf) to have Ghostscript's "cups"/"pwgraster"/"appleraster"/"urf" output devices support working fully PPD-less, allowing to supply all parameters by command line. This makes the transition to cups-filters 2.x in Ubuntu 23.04 easier. * Updated debian/libgs9.symbols. -- Till Kamppeter <email address hidden> Wed, 24 Aug 2022 22:00:00 +0200
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.16) bionic-security; urgency=medium * SECURITY UPDATE: old code execution issue - debian/patches/CVE-2019-25059-1.patch: undef .completefont in Resource/Init/gs_fonts.ps, Resource/Init/gs_init.ps, Resource/Init/gs_ttf.ps. - debian/patches/CVE-2019-25059-2.patch: undef .origdefinefont, .origundefinefont, .origfindfont in Resource/Init/gs_init.ps, Resource/Init/gs_res.ps. - CVE-2019-25059 -- Marc Deslauriers <email address hidden> Wed, 27 Apr 2022 08:27:55 -0400
Available diffs
Superseded in kinetic-release |
Published in jammy-release |
Deleted in jammy-proposed (Reason: Moved to jammy) |
ghostscript (9.55.0~dfsg1-0ubuntu5) jammy; urgency=medium * No-change rebuild for ppc64el baseline bump. -- Łukasz 'sil2100' Zemczak <email address hidden> Wed, 23 Mar 2022 14:54:34 +0100
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.15) bionic-security; urgency=medium * SECURITY UPDATE: use-after-free in sampled_data_sample - debian/patches/CVE-2021-45944.patch: check stack limits after function evaluation in psi/zfsample.c. - CVE-2021-45944 * SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish - debian/patches/CVE-2021-45949.patch: fix op stack management in psi/zfsample.c. - CVE-2021-45949 -- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:22:40 -0500
Available diffs
ghostscript (9.54.0~dfsg1-0ubuntu2.1) impish-security; urgency=medium * SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish - debian/patches/CVE-2021-45949.patch: fix op stack management in psi/zfsample.c. - CVE-2021-45949 -- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:19:13 -0500
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.5) focal-security; urgency=medium * SECURITY UPDATE: use-after-free in sampled_data_sample - debian/patches/CVE-2021-45944.patch: check stack limits after function evaluation in psi/zfsample.c. - CVE-2021-45944 * SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish - debian/patches/CVE-2021-45949.patch: fix op stack management in psi/zfsample.c. - CVE-2021-45949 -- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:22:11 -0500
ghostscript (9.53.3~dfsg-7ubuntu0.2) hirsute-security; urgency=medium * SECURITY UPDATE: use-after-free in sampled_data_sample - debian/patches/CVE-2021-45944.patch: check stack limits after function evaluation in psi/zfsample.c. - CVE-2021-45944 * SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish - debian/patches/CVE-2021-45949.patch: fix op stack management in psi/zfsample.c. - CVE-2021-45949 -- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:20:41 -0500
ghostscript (9.55.0~dfsg1-0ubuntu4) jammy; urgency=medium * Just mark all libtesseract symbols optional and be done with it. -- Steve Langasek <email address hidden> Tue, 07 Dec 2021 21:21:02 +0000
Available diffs
Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu3) jammy; urgency=medium * Mark as optional various symbols which are leaked from the embedded tesseract library and are not part of the public API, and which are also arch-specific so causing build failures on non-x86. -- Steve Langasek <email address hidden> Tue, 07 Dec 2021 20:27:02 +0000
Available diffs
Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu2) jammy; urgency=medium * Merge with Debian unstable. Remaining changes: - New re-packaging of Ghostscript 9.54.0, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. - Updated debian/libgs9.symbols.
Available diffs
Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu1) jammy; urgency=low * Merge from Debian unstable. Remaining changes: - New re-packaging of Ghostscript 9.54.0, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. * Updated debian/libgs9.symbols. -- Till Kamppeter <email address hidden> Mon, 22 Nov 2021 18:24:56 +0100
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.4) focal; urgency=medium * debian/patches/2021_fix-double-hyphen-option.patch: Fix bug where using '--' command line syntax fails to read input files (LP: #1913656) -- William 'jawn-smith' Wilson <email address hidden> Thu, 14 Oct 2021 15:32:37 -0500
Available diffs
Superseded in jammy-proposed |
ghostscript (9.54.0~dfsg1-0ubuntu3) jammy; urgency=medium * No-change rebuild against libidn12 -- Steve Langasek <email address hidden> Sun, 07 Nov 2021 05:32:06 +0000
Available diffs
Superseded in jammy-release |
Obsolete in impish-release |
Deleted in impish-proposed (Reason: Moved to impish) |
ghostscript (9.54.0~dfsg1-0ubuntu2) impish; urgency=medium * SECURITY UPDATE: Trivial -dSAFER bypass - debian/patches/CVE-2021-3781.patch: include device specifier strings in access validation in base/gdevpipe.c, base/gp_mshdl.c, base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c. - CVE-2021-3781 -- Marc Deslauriers <email address hidden> Fri, 10 Sep 2021 07:59:00 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.3) focal-security; urgency=medium * SECURITY UPDATE: Trivial -dSAFER bypass - debian/patches/CVE-2021-3781-pre1.patch: handle format strings in pipe OutputFiles in base/gslibctx.c. - debian/patches/CVE-2021-3781-pre2.patch: fix pdfwrite "%d" mode with file permissions in base/gsdevice.c, base/gslibctx.c. - debian/patches/CVE-2021-3781-pre3.patch: move "break" to correct place in base/gslibctx.c. - debian/patches/CVE-2021-3781.patch: include device specifier strings in access validation in base/gdevpipe.c, base/gp_mshdl.c, base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c. - CVE-2021-3781 -- Marc Deslauriers <email address hidden> Thu, 09 Sep 2021 09:34:31 -0400
ghostscript (9.53.3~dfsg-7ubuntu0.1) hirsute-security; urgency=medium * SECURITY UPDATE: Trivial -dSAFER bypass - debian/patches/CVE-2021-3781.patch: include device specifier strings in access validation in base/gdevpipe.c, base/gp_mshdl.c, base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c. - CVE-2021-3781 -- Marc Deslauriers <email address hidden> Thu, 09 Sep 2021 09:00:55 -0400
Available diffs
ghostscript (9.54.0~dfsg1-0ubuntu1) impish; urgency=medium * New re-packaging of Ghostscript 9.54.0, keeping the leptonica and tesseract convenience copies in as they are not in Ubuntu Main. Added appropriate remark to debian/copyright. * De-activated the extract library/"docxwrite" device. This did not build and Debian also seems to not use it. Used the --without-extract-dir option on ./configure for that. * "Downgrade" dh_missing from --fail-missing to --list-missing to avoid FTBFS on non-amd64 from compat 13 on * Updated debian/libgs9.symbols. -- Till Kamppeter <email address hidden> Thu, 19 Aug 2021 11:54:46 +0200
Available diffs
Deleted in impish-proposed (Reason: FTBFS, removed at request of ricotz) |
ghostscript (9.54.0~dfsg-1) experimental; urgency=medium [ upstream ] * new release * update copyright info: + exclude comvenience copies of projects libextract, leptonica, and tesseract + update coverage + update source helper tool copyright-check: implement option --merge-licenses * drop patches cherry-picked upstream since applied * unfuzz patches * add patches cherry-picked upstream: + improve description of configure.ac option --with-extract-dir + fix magic number used in pam device + fix MacOS/tesseract build problems on Unix systems + work with latest Extract library + bounds check name table "string" + add some relevant flags to the cups compilation + do not lie about emitting Multiple Master fonts in psfwrite + add a PassThrough for JPX encoded images to pdfwrite + fix missing interior of rectangles (regression in 9.54.0) + tweak Leptonica/Tesseract memory allocators * add patch 1004 to enable DeviceN-related device xcfcmyk * use debhelper compatibility level 13 (not 12) -- Jonas Smedegaard <email address hidden> Sun, 18 Jul 2021 15:07:19 +0200
Superseded in impish-release |
Obsolete in hirsute-release |
Deleted in hirsute-proposed (Reason: moved to Release) |
ghostscript (9.53.3~dfsg-7) unstable; urgency=medium * update previous changelog section, add a bug closure. * update source helper script copyright-check. * copyright: update coverage * add patches cherry-picked upstream: + re-enable support for opvp/oprp devices; closes: bug#980971, thanks to Chris Bainbridge + parse some types of broken PDFs; closes: bug#981583, thanks to Rogério Brito + fix segfault parsing large Postscript file; closes: bug#970878, thanks to Paul Gevers, Bernhard Übelacker, Iustin Pop and Stefano Rivera * update symbols: 4 private symbols added -- Jonas Smedegaard <email address hidden> Tue, 02 Feb 2021 14:18:01 +0100
Available diffs
- diff from 9.53.3~dfsg-6 to 9.53.3~dfsg-7 (18.2 KiB)
ghostscript (9.26~dfsg+0-0ubuntu0.16.04.14) xenial-security; urgency=medium * SECURITY UPDATE: integer overflow in opj_t1_encode_cblks - debian/patches/CVE-2018-5727.patch: fix UBSAN signed integer overflow in openjpeg/src/lib/openjp2/t1.c. - CVE-2018-5727 * SECURITY UPDATE: heap overflow in opj_t1_clbl_decode_processor - debian/patches/CVE-2020-6851.patch: reject images whose coordinates are beyond INT_MAX in openjpeg/src/lib/openjp2/j2k.c. - CVE-2020-6851 * SECURITY UPDATE: another heap overflow in opj_t1_clbl_decode_processor - debian/patches/CVE-2020-8112.patch: avoid integer overflow in openjpeg/src/lib/openjp2/tcd.c. - CVE-2020-8112 * SECURITY UPDATE: heap-buffer-overflow - debian/patches/CVE-2020-27814-1.patch: grow buffer size in openjpeg/src/lib/openjp2/tcd.c. - debian/patches/CVE-2020-27814-2.patch: grow it again - debian/patches/CVE-2020-27814-3.patch: and some more - debian/patches/CVE-2020-27814-4.patch: bigger, BIGGER!!! - CVE-2020-27814 * SECURITY UPDATE: global-buffer-overflow - debian/patches/CVE-2020-27824.patch: avoid global buffer overflow on irreversible conversion when too many decomposition levels are specified in openjpeg/src/lib/openjp2/dwt.c. - CVE-2020-27824 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27841.patch: add extra checks to openjpeg/src/lib/openjp2/pi.c, openjpeg/src/lib/openjp2/pi.h, openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27841 * SECURITY UPDATE: null pointer dereference - debian/patches/CVE-2020-27842.patch: add check to openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27842 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27843.patch: add check to openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27843 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27845.patch: add extra checks to openjpeg/src/lib/openjp2/pi.c. - CVE-2020-27845 -- Marc Deslauriers <email address hidden> Wed, 06 Jan 2021 12:44:08 -0500
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.14) bionic-security; urgency=medium * SECURITY UPDATE: integer overflow in opj_t1_encode_cblks - debian/patches/CVE-2018-5727.patch: fix UBSAN signed integer overflow in openjpeg/src/lib/openjp2/t1.c. - CVE-2018-5727 * SECURITY UPDATE: heap overflow in opj_t1_clbl_decode_processor - debian/patches/CVE-2020-6851.patch: reject images whose coordinates are beyond INT_MAX in openjpeg/src/lib/openjp2/j2k.c. - CVE-2020-6851 * SECURITY UPDATE: another heap overflow in opj_t1_clbl_decode_processor - debian/patches/CVE-2020-8112.patch: avoid integer overflow in openjpeg/src/lib/openjp2/tcd.c. - CVE-2020-8112 * SECURITY UPDATE: heap-buffer-overflow - debian/patches/CVE-2020-27814-1.patch: grow buffer size in openjpeg/src/lib/openjp2/tcd.c. - debian/patches/CVE-2020-27814-2.patch: grow it again - debian/patches/CVE-2020-27814-3.patch: and some more - debian/patches/CVE-2020-27814-4.patch: bigger, BIGGER!!! - CVE-2020-27814 * SECURITY UPDATE: global-buffer-overflow - debian/patches/CVE-2020-27824.patch: avoid global buffer overflow on irreversible conversion when too many decomposition levels are specified in openjpeg/src/lib/openjp2/dwt.c. - CVE-2020-27824 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27841.patch: add extra checks to openjpeg/src/lib/openjp2/pi.c, openjpeg/src/lib/openjp2/pi.h, openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27841 * SECURITY UPDATE: null pointer dereference - debian/patches/CVE-2020-27842.patch: add check to openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27842 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27843.patch: add check to openjpeg/src/lib/openjp2/t2.c. - CVE-2020-27843 * SECURITY UPDATE: out-of-bounds read - debian/patches/CVE-2020-27845.patch: add extra checks to openjpeg/src/lib/openjp2/pi.c. - CVE-2020-27845 -- Marc Deslauriers <email address hidden> Wed, 06 Jan 2021 12:44:08 -0500
Available diffs
ghostscript (9.53.3~dfsg-6) unstable; urgency=medium * copyright-check: + fix quote path when creating temporary skipfile + ignore skipfiles below debian/ + compute robust file regex from content with regexp-assemble + list dependencies in header comment * add source helper tools patch-cherry-pick patch-mkseries patch-refresh-all * copyright: + update coverage + consistently wrap Files and Copyright paragraphs (sole exception being initial wildcard Files paragraph) * add patch cherry-picked upstream, and patch by Stefano Rivera, to fix endian issues with CMM; closes: bug#976177, thanks to Stefano Rivera * declare compliance with Debian Policy 4.5.1 * update git-buildpackage settings: + use DEP-14 git branch names + add usage comment * add patch cherry-picked upstream to fix linking with libfreetype 2.10.3 and newer -- Jonas Smedegaard <email address hidden> Wed, 23 Dec 2020 02:51:22 +0100
Available diffs
ghostscript (9.53.3~dfsg-5ubuntu2) hirsute; urgency=medium * Patch 0003: Revert 278f9a53 "txtwrite - better processing of text in type 3 fonts". Fixing segfault in doc-rfc autopkgtest. (Closes: #970878) -- Stefano Rivera <email address hidden> Mon, 30 Nov 2020 18:55:30 -0800
Available diffs
Superseded in hirsute-proposed |
ghostscript (9.53.3~dfsg-5ubuntu1) hirsute; urgency=medium * Patch 0001, 0002: Fix big-endian CMM-handling bug leading to segfault in the ocrmypdf autopkgtest. (Closes: #976177) -- Stefano Rivera <email address hidden> Mon, 30 Nov 2020 16:39:58 -0800
Available diffs
Superseded in hirsute-proposed |
ghostscript (9.53.3~dfsg-5) unstable; urgency=medium * simplify build routines slightly * tighten source script copyright-check * update copyright hints * relax tracking of symlinks to fonts-urw-base35 to ignore file contents; closes: bug#972896, thanks to Fabian Greffrath -- Jonas Smedegaard <email address hidden> Mon, 26 Oct 2020 11:04:53 +0100
ghostscript (9.26~dfsg+0-0ubuntu0.16.04.13) xenial-security; urgency=medium * SECURITY UPDATE: Multiple security issues - debian/patches/CVE-2020-16*.patch: backport multiple upstream commits to fix various security issues. - CVE-2020-16287, CVE-2020-16288, CVE-2020-16289, CVE-2020-16290, CVE-2020-16291, CVE-2020-16292, CVE-2020-16293, CVE-2020-16294, CVE-2020-16295, CVE-2020-16296, CVE-2020-16297, CVE-2020-16298, CVE-2020-16299, CVE-2020-16300, CVE-2020-16301, CVE-2020-16302, CVE-2020-16303, CVE-2020-16304, CVE-2020-16305, CVE-2020-16306, CVE-2020-16307, CVE-2020-16308, CVE-2020-16309, CVE-2020-16310, CVE-2020-17538 -- Marc Deslauriers <email address hidden> Fri, 21 Aug 2020 13:16:34 -0400
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.13) bionic-security; urgency=medium * SECURITY UPDATE: Multiple security issues - debian/patches/CVE-2020-16*.patch: backport multiple upstream commits to fix various security issues. - CVE-2020-16287, CVE-2020-16288, CVE-2020-16289, CVE-2020-16290, CVE-2020-16291, CVE-2020-16292, CVE-2020-16293, CVE-2020-16294, CVE-2020-16295, CVE-2020-16296, CVE-2020-16297, CVE-2020-16298, CVE-2020-16299, CVE-2020-16300, CVE-2020-16301, CVE-2020-16302, CVE-2020-16303, CVE-2020-16304, CVE-2020-16305, CVE-2020-16306, CVE-2020-16307, CVE-2020-16308, CVE-2020-16309, CVE-2020-16310, CVE-2020-17538 -- Marc Deslauriers <email address hidden> Fri, 21 Aug 2020 13:09:58 -0400
1 → 75 of 406 results | First • Previous • Next • Last |