Change log for ghostscript package in Ubuntu
| 1 → 75 of 406 results | First • Previous • Next • Last |
ghostscript (10.03.1~dfsg1-0ubuntu2) oracular; urgency=low
* Do not compile with Neon FPU support on 32-bit ARM (see also Debian bug
#1012254). Otherwise we get FTBFS on armhf.
-- Till Kamppeter <email address hidden> Mon, 12 Aug 2024 00:00:01 +0200
Available diffs
| Superseded in oracular-proposed |
ghostscript (10.03.1~dfsg1-0ubuntu1) oracular; urgency=low
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.03.1, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
* Drop CVE* patches, included upstream.
-- Till Kamppeter <email address hidden> Thu, 10 Aug 2024 20:46:21 +0200
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.9) jammy-security; urgency=medium
* SECURITY UPDATE: stack-based buffer overflow via long PDF filter name
- debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad
Filters to overflow the debug buffer in pdf/pdf_file.c.
- CVE-2024-29506
* SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont
name
- debian/patches/CVE-2024-29508.patch: review printing of pointers in
base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c,
base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c,
devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c,
psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c.
- debian/patches/CVE-2024-29508-2.patch: remove extra arguments in
devices/gdevupd.c.
- CVE-2024-29508
* SECURITY UPDATE: heap-based overflow via PDFPassword with null byte
- debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in
pdf/pdf_sec.c.
- CVE-2024-29509
* SECURITY UPDATE: directory traversal issue via OCRLanguage
- debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after
SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdfp.c.
- debian/patches/CVE-2024-29511-2.patch: original fix was overly
aggressive in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c.
- debian/libgs9.symbols: mark some symbols as optional.
- CVE-2024-29511
-- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:07:09 -0400
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu9) oracular; urgency=medium
* debian/patches/CVE-2024-29511-2.patch: original fix was overly
aggressive in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c.
-- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:25:28 -0400
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu7.3) noble-security; urgency=medium
* SECURITY UPDATE: stack-based buffer overflow via long PDF filter name
- debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad
Filters to overflow the debug buffer in pdf/pdf_file.c.
- CVE-2024-29506
* SECURITY UPDATE: stack-based buffer overflows
- debian/patches/CVE-2024-29507.patch: bounds checks when using CIDFont
related params in pdf/pdf_font.c, pdf/pdf_warnings.h.
- CVE-2024-29507
* SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont
name
- debian/patches/CVE-2024-29508.patch: review printing of pointers in
base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c,
base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c,
devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c,
psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c.
- debian/patches/CVE-2024-29508-2.patch: fix compiler warning in
optimised build in base/gsicc_cache.c.
- debian/patches/CVE-2024-29508-3.patch: remove extra arguments in
devices/gdevupd.c.
- CVE-2024-29508
* SECURITY UPDATE: heap-based overflow via PDFPassword with null byte
- debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in
pdf/pdf_sec.c.
- CVE-2024-29509
* SECURITY UPDATE: directory traversal issue via OCRLanguage
- debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after
SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdfp.c.
- debian/patches/CVE-2024-29511-2.patch: original fix was overly
aggressive in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdf.c, devices/vector/gdevpdfp.c.
- CVE-2024-29511
-- Marc Deslauriers <email address hidden> Thu, 11 Jul 2024 12:07:09 -0400
Available diffs
| Superseded in oracular-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu8) oracular; urgency=medium
[ Marc Deslauriers }
* SECURITY UPDATE: stack-based buffer overflow via long PDF filter name
- debian/patches/CVE-2024-29506.patch: don't allow PDF files with bad
Filters to overflow the debug buffer in pdf/pdf_file.c.
- CVE-2024-29506
* SECURITY UPDATE: stack-based buffer overflows
- debian/patches/CVE-2024-29507.patch: bounds checks when using CIDFont
related params in pdf/pdf_font.c, pdf/pdf_warnings.h.
- CVE-2024-29507
* SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont
name
- debian/patches/CVE-2024-29508.patch: review printing of pointers in
base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c,
base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c,
devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c,
psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c.
- debian/patches/CVE-2024-29508-2.patch: fix compiler warning in
optimised build in base/gsicc_cache.c.
- debian/patches/CVE-2024-29508-3.patch: remove extra arguments in
devices/gdevupd.c.
- CVE-2024-29508
* SECURITY UPDATE: heap-based overflow via PDFPassword with null byte
- debian/patches/CVE-2024-29509.patch: don't use strlen on passwords in
pdf/pdf_sec.c.
- CVE-2024-29509
* SECURITY UPDATE: directory traversal issue via OCRLanguage
- debian/patches/CVE-2024-29511.patch: reject OCRLanguage changes after
SAFER enabled in devices/gdevocr.c, devices/gdevpdfocr.c,
devices/vector/gdevpdfp.c.
- CVE-2024-29511
[ Chris Kim ]
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Marc Deslauriers <email address hidden> Wed, 10 Jul 2024 13:28:20 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.13) focal-security; urgency=medium
* SECURITY UPDATE: heap-based pointer disclosure via constructed BaseFont
name
- debian/patches/CVE-2024-29508.patch: review printing of pointers in
base/gsfont.c, base/gsicc_cache.c, base/gsmalloc.c, base/gxclmem.c,
base/gxcpath.c, base/gxpath.c, base/szlibc.c, devices/gdevupd.c,
devices/vector/gdevpdtb.c, psi/ialloc.c, psi/igc.c, psi/igcstr.c,
psi/iinit.c, psi/imainarg.c, psi/isave.c, psi/iutil.c.
- debian/patches/CVE-2024-29508-2.patch: remove extra arguments in
devices/gdevupd.c.
- CVE-2024-29508
-- Marc Deslauriers <email address hidden> Wed, 10 Jul 2024 09:40:58 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.12) focal-security; urgency=medium
* SECURITY UPDATE: Policy bypass via improperly checked eexec seed
- debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than
Type 1 standard when SAFER mode is used in zmisc1.c.
- CVE-2023-52722
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Chris Kim <email address hidden> Tue, 04 Jun 2024 08:30:59 -0700
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.7) jammy-security; urgency=medium
* SECURITY UPDATE: Policy bypass via improperly checked eexec seed
- debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than
Type 1 standard when SAFER mode is used in zmisc1.c.
- CVE-2023-52722
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Chris Kim <email address hidden> Mon, 03 Jun 2024 21:54:57 -0700
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu2.3) mantic-security; urgency=medium
* SECURITY UPDATE: Policy bypass via improperly checked eexec seed
- debian/patches/CVE-2023-52722.patch: Prevent eexec seeds other than
Type 1 standard when SAFER mode is used in zmisc1.c.
- CVE-2023-52722
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Chris Kim <email address hidden> Mon, 03 Jun 2024 14:47:09 -0700
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu7.1) noble-security; urgency=medium
* SECURITY UPDATE: Arbitrary code execution via uniprint device
- debian/patches/CVE-2024-29510.patch: Prevent changes to uniprint device
argument strings after SAFER is activated in gdevupd.c.
- CVE-2024-29510
* SECURITY UPDATE: Path traversal and arbitrary code execution via improperly
checked path arguments
- debian/patches/CVE-2024-33869-part1.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- debian/patches/CVE-2024-33869-part2.patch: Check that a current working
directory specifier is valid before stripping it from gpmisc.c.
- CVE-2024-33869
* SECURITY UPDATE: Path traversal via improperly checked path arguments
- debian/patches/CVE-2024-33870.patch: Add a check for parent directory
prefixes when handling relative paths in gpmisc.c.
- CVE-2024-33870
* SECURITY UPDATE: Arbitrary code execution via custom driver library
- debian/patches/CVE-2024-33871.patch: Prevent changes to parameter that
specifies the names of dynamic libraries to be loaded by the opvp/oprp
device in gdevopvp.c
- CVE-2024-33871
-- Chris Kim <email address hidden> Wed, 05 Jun 2024 10:32:38 -0700
Available diffs
| Superseded in oracular-release |
| Published in noble-release |
| Deleted in noble-proposed (Reason: Moved to noble) |
ghostscript (10.02.1~dfsg1-0ubuntu7) noble; urgency=high * No change rebuild against libcups2t64, libpng16-16t64, libxt6t64. -- Julian Andres Klode <email address hidden> Mon, 08 Apr 2024 16:39:44 +0200
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu6) noble; urgency=medium * No-change rebuild for CVE-2024-3094 -- Steve Langasek <email address hidden> Sat, 30 Mar 2024 23:49:24 +0000
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu5) noble; urgency=medium * No-change rebuild against libcups2t64. -- Michael Hudson-Doyle <email address hidden> Wed, 20 Mar 2024 13:48:31 +1300
Available diffs
| Superseded in noble-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu4) noble; urgency=medium * No-change rebuild against libxt6t64 -- Steve Langasek <email address hidden> Sat, 09 Mar 2024 00:49:00 +0000
| Superseded in noble-proposed |
ghostscript (10.02.1~dfsg1-0ubuntu3) noble; urgency=medium
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.02.1, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
[ наб ]
* [ee3d1ac] Simplify /sbin/update-gsfontmap (Closes: #992889)
[ Steve Robbins ]
* [ccc0e3c] Explicitly set font map files to be world readable.
Closes: #740959.
* [5fce3d3] Add suggestion for package texlive-binaries, needed to use dvipdf. Closes: #782901.
* [9ab8028] ghostscript: add conflicts to ghostcript-x to allow removal of the obsolete transitional package. Closes: #1053377
-- Till Kamppeter <email address hidden> Thu, 29 Feb 2024 01:30:05 +0100
Available diffs
| Deleted in noble-updates (Reason: superseded by release) |
| Superseded in noble-release |
| Deleted in noble-proposed (Reason: Moved to noble) |
ghostscript (10.02.1~dfsg1-0ubuntu2) noble; urgency=medium
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.02.1, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
[ Steve Robbins ]
* [4b077b5] Incorporate upstream patch to fix PageList processing in PDF
handler. Closes: #1052652
* [b4524f9] New maintainer. Closes: #1022718, #1036869.
-- Till Kamppeter <email address hidden> Sat, 06 Jan 2024 19:16:05 -0300
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.6) jammy-security; urgency=medium
* SECURITY UPDATE: DoS via dangling pointer
- debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for
seekable output files in base/gdevprn.c, devices/gdevtsep.c.
- CVE-2023-46751
-- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:25:45 -0500
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu2.2) mantic-security; urgency=medium
* SECURITY UPDATE: DoS via dangling pointer
- debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for
seekable output files in base/gdevprn.c, devices/gdevtsep.c.
- CVE-2023-46751
-- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:22:28 -0500
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.5) lunar-security; urgency=medium
* SECURITY UPDATE: DoS via dangling pointer
- debian/patches/CVE-2023-46751.patch: fix tiffsep(1) requirement for
seekable output files in base/gdevprn.c, devices/gdevtsep.c.
- CVE-2023-46751
-- Marc Deslauriers <email address hidden> Mon, 11 Dec 2023 14:25:02 -0500
Available diffs
ghostscript (10.02.1~dfsg1-0ubuntu1) noble; urgency=medium
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.02.1, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
* Drop CVE* patches, included upstream.
-- Till Kamppeter <email address hidden> Thu, 07 Dec 2023 19:05:05 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.5) jammy-security; urgency=medium
* SECURITY UPDATE: code execution via PS documents and IJS device
- debian/patches/CVE-2023-43115.patch: prevent PostScript programs
switching to the IJS device after SAFER has been activated in
devices/gdevijs.c.
- CVE-2023-43115
-- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:02:58 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.11) focal-security; urgency=medium
* SECURITY UPDATE: code execution via PS documents and IJS device
- debian/patches/CVE-2023-43115.patch: prevent PostScript programs
switching to the IJS device after SAFER has been activated in
devices/gdevijs.c.
- CVE-2023-43115
-- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:06:46 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.4) lunar-security; urgency=medium
* SECURITY UPDATE: code execution via PS documents and IJS device
- debian/patches/CVE-2023-43115.patch: prevent PostScript programs
switching to the IJS device after SAFER has been activated in
devices/gdevijs.c.
- CVE-2023-43115
-- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 09:02:25 -0400
Available diffs
| Superseded in noble-release |
| Deleted in noble-proposed (Reason: Moved to noble) |
| Superseded in noble-proposed |
| Superseded in mantic-updates |
| Superseded in mantic-security |
ghostscript (10.01.2~dfsg1-0ubuntu2.1) mantic-security; urgency=medium
* SECURITY UPDATE: code execution via PS documents and IJS device
- debian/patches/CVE-2023-43115.patch: prevent PostScript programs
switching to the IJS device after SAFER has been activated in
devices/gdevijs.c.
- CVE-2023-43115
-- Marc Deslauriers <email address hidden> Thu, 12 Oct 2023 08:59:19 -0400
Available diffs
- diff from 10.01.2~dfsg1-0ubuntu2 (in Ubuntu) to 10.01.2~dfsg1-0ubuntu2.1 (1.7 KiB)
- diff from 10.0.0~dfsg1-0ubuntu3 to 10.01.2~dfsg1-0ubuntu2.1 (pending)
| Superseded in noble-release |
| Published in mantic-release |
| Deleted in mantic-proposed (Reason: Moved to mantic) |
ghostscript (10.01.2~dfsg1-0ubuntu2) mantic; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to
deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c.
- CVE-2023-38559
-- Allen Huang <email address hidden> Thu, 21 Sep 2023 17:06:57 +0200
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.10) focal-security; urgency=medium
* SECURITY UPDATE: Divide By Zero
- debian/patches/CVE-2020-21710-1.patch: add a zero check for
bytes_per_space before using it for division in eps_print_page() in
devices/gdevepsn.c.
- debian/patches/CVE-2020-21710-2.patch: add a zero check for
bytes_per_space before using it for division in epsc_print_page() in
devices/gdevepsc.c
- CVE-2020-21710
* SECURITY UPDATE: Out-of-Bounds Write
- debian/patches/CVE-2020-21890-pre.patch: add the float res assignment
in clj_get_params() in devices/gdevclj.c.
- debian/patches/CVE-2020-21890.patch: change the variable for division
to use res instead of fres.data that could be uninitialized, in
clj_media_size() in devices/gdevclj.c.
- CVE-2020-21890
-- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 12 Sep 2023 11:40:34 -0300
Available diffs
ghostscript (10.01.2~dfsg1-0ubuntu1) mantic; urgency=low
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.00.0, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.3) lunar-security; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to
deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c.
- CVE-2023-38559
-- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:25:30 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.4) jammy-security; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to
deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c.
- CVE-2023-38559
-- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:40:49 +0100
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.9) focal-security; urgency=medium
* SECURITY UPDATE: buffer overflow
- debian/patches/CVE-2023-38559.patch: bounds check the buffer prior to
deferencing the pointer in devn_pcx_write_rle() in base/gdevdevn.c.
- CVE-2023-38559
-- Allen Huang <email address hidden> Tue, 15 Aug 2023 11:17:37 +0100
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.3) jammy-security; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:49:52 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu2) mantic; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:45:07 -0400
Available diffs
ghostscript (10.0.0~dfsg1-0ubuntu1.2) lunar-security; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:45:07 -0400
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu3.2) kinetic-security; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:49:15 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.8) focal-security; urgency=medium
* SECURITY UPDATE: incorrect permission validation for pipe devices
- debian/patches/CVE-2023-36664-pre1.patch: improve handling of current
directory permissions in base/gpmisc.c.
- debian/patches/CVE-2023-36664-pre2.patch: fix gp_file allocations to
use thread_safe_memory in base/gpmisc.c.
- debian/patches/CVE-2023-36664-1.patch: don't reduce pipe file names
for permission validation in base/gpmisc.c, base/gslibctx.c.
- debian/patches/CVE-2023-36664-2.patch: fix logic and add extra test
in base/gpmisc.c, base/gslibctx.c.
- CVE-2023-36664
-- Marc Deslauriers <email address hidden> Wed, 05 Jul 2023 12:56:27 -0400
Available diffs
| Superseded in mantic-release |
| Deleted in mantic-proposed (Reason: Moved to mantic) |
| Superseded in lunar-updates |
| Superseded in lunar-security |
ghostscript (10.0.0~dfsg1-0ubuntu1.1) lunar-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2023-28879.patch: add check to make sure that the
buffer has space for two characters in s_xBCPE_process() in base/sbcp.c.
- debian/patches/CVE-2023-28879-post.patch: add PostScript filters
removals in Resource/Init/gs_init.ps.
- CVE-2023-28879
-- Rodrigo Figueiredo Zaiden <email address hidden> Tue, 25 Apr 2023 16:29:39 -0300
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu3.1) kinetic-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2023-28879.patch: add check to make sure that the
buffer has space for two characters in s_xBCPE_process() in base/sbcp.c.
- debian/patches/CVE-2023-28879-post.patch: add PostScript filters
removals in Resource/Init/gs_init.ps.
- CVE-2023-28879
-- Rodrigo Figueiredo Zaiden <email address hidden> Wed, 12 Apr 2023 21:24:02 -0300
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.2) jammy-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2023-28879.patch: add check to make sure that the
buffer has space for two characters in s_xBCPE_process() in base/sbcp.c.
- CVE-2023-28879
-- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 11:15:40 -0300
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.7) focal-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2023-28879.patch: add check to make sure that the
buffer has space for two characters in s_xBCPE_process() in base/sbcp.c.
- CVE-2023-28879
-- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 10:48:39 -0300
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.18) bionic-security; urgency=medium
* SECURITY UPDATE: Buffer Overflow
- debian/patches/CVE-2023-28879.patch: add check to make sure that the
buffer has space for two characters in s_xBCPE_process() in base/sbcp.c.
- CVE-2023-28879
-- Rodrigo Figueiredo Zaiden <email address hidden> Thu, 13 Apr 2023 10:09:22 -0300
Available diffs
| Superseded in mantic-release |
| Published in lunar-release |
| Deleted in lunar-proposed (Reason: Moved to lunar) |
ghostscript (10.0.0~dfsg1-0ubuntu1) lunar; urgency=low
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 10.00.0, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Just mark all libtesseract symbols optional and be done with it.
They are also arch-specific so causing build failures on non-x86.
- Also keep the lcms2mt convenience copy as it is heavily patched by
Ghostscript's upstream developers, especially for multi-threading
(mt) support.
- Upstream patch (commit 387f094) for the CUPS/PWG/Apple Raster
output device not to match custom page sizes against the sizes defined
in the PPD file, to avoid unwished rotations or size adjustments.
(cups-filters upstream issue #484).
Available diffs
| Superseded in lunar-proposed |
ghostscript (9.56.1~dfsg1-0ubuntu4) lunar; urgency=medium * Rebuild against latest tiff -- Jeremy Bicha <email address hidden> Sat, 04 Feb 2023 15:24:23 -0500
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.6) focal-security; urgency=medium
* SECURITY UPDATE: heap-based buffer overflow in lp8000_print_page()
- debian/patches/CVE-2020-27792.patch: fixed output buffer size worst
case in devices/gdevlp8k.c.
- CVE-2020-27792
-- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:40:09 -0400
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.17) bionic-security; urgency=medium
* SECURITY UPDATE: heap-based buffer overflow in lp8000_print_page()
- debian/patches/CVE-2020-27792.patch: fixed output buffer size worst
case in devices/gdevlp8k.c.
- CVE-2020-27792
-- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:43:27 -0400
Available diffs
ghostscript (9.55.0~dfsg1-0ubuntu5.1) jammy-security; urgency=medium
* SECURITY UPDATE: NULL pointer dereference issue
- debian/patches/CVE-2022-2085.patch: add init_device_procs entry for
mem_x_device in base/gdevmx.c.
- CVE-2022-2085
-- Marc Deslauriers <email address hidden> Mon, 26 Sep 2022 10:05:05 -0400
| Superseded in lunar-release |
| Obsolete in kinetic-release |
| Deleted in kinetic-proposed (Reason: Moved to kinetic) |
ghostscript (9.56.1~dfsg1-0ubuntu3) kinetic; urgency=low
* Added upstream patch (commit 387f094) for the CUPS/PWG/Apple Raster
output device not to match custom page sizes against the sizes defined
in the PPD file, to avoid unwished rotations or size adjustments.
(cups-filters upstream issue #484).
-- Till Kamppeter <email address hidden> Sun, 25 Sep 2022 10:26:00 +0200
Available diffs
ghostscript (9.56.1~dfsg1-0ubuntu2) kinetic; urgency=low
* Added upstream patch (commit 2a54c67) to use stable memory for
pdfi streams, to avoid double-free when "runpdfend" when done
with a PDF interpreter started with "runpdfbegin". This caused the
autopkgtest of xfig to fail (Upstream bugs #705855, #705836, #705210).
-- Till Kamppeter <email address hidden> Thu, 08 Sep 2022 13:00:00 +0200
Available diffs
| Superseded in kinetic-proposed |
ghostscript (9.56.1~dfsg1-0ubuntu1) kinetic; urgency=low
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 9.56.1, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Just mark all libtesseract symbols optional and be done with it.
They are also arch-specific so causing build failures on non-x86.
* Added upstream patch (commit 1f876cf) to have Ghostscript's
"cups"/"pwgraster"/"appleraster"/"urf" output devices support working
fully PPD-less, allowing to supply all parameters by command line. This
makes the transition to cups-filters 2.x in Ubuntu 23.04 easier.
* Updated debian/libgs9.symbols.
-- Till Kamppeter <email address hidden> Wed, 24 Aug 2022 22:00:00 +0200
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.16) bionic-security; urgency=medium
* SECURITY UPDATE: old code execution issue
- debian/patches/CVE-2019-25059-1.patch: undef .completefont in
Resource/Init/gs_fonts.ps, Resource/Init/gs_init.ps,
Resource/Init/gs_ttf.ps.
- debian/patches/CVE-2019-25059-2.patch: undef .origdefinefont,
.origundefinefont, .origfindfont in Resource/Init/gs_init.ps,
Resource/Init/gs_res.ps.
- CVE-2019-25059
-- Marc Deslauriers <email address hidden> Wed, 27 Apr 2022 08:27:55 -0400
Available diffs
| Superseded in kinetic-release |
| Published in jammy-release |
| Deleted in jammy-proposed (Reason: Moved to jammy) |
ghostscript (9.55.0~dfsg1-0ubuntu5) jammy; urgency=medium * No-change rebuild for ppc64el baseline bump. -- Łukasz 'sil2100' Zemczak <email address hidden> Wed, 23 Mar 2022 14:54:34 +0100
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.15) bionic-security; urgency=medium
* SECURITY UPDATE: use-after-free in sampled_data_sample
- debian/patches/CVE-2021-45944.patch: check stack limits after
function evaluation in psi/zfsample.c.
- CVE-2021-45944
* SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish
- debian/patches/CVE-2021-45949.patch: fix op stack management in
psi/zfsample.c.
- CVE-2021-45949
-- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:22:40 -0500
Available diffs
ghostscript (9.54.0~dfsg1-0ubuntu2.1) impish-security; urgency=medium
* SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish
- debian/patches/CVE-2021-45949.patch: fix op stack management in
psi/zfsample.c.
- CVE-2021-45949
-- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:19:13 -0500
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.5) focal-security; urgency=medium
* SECURITY UPDATE: use-after-free in sampled_data_sample
- debian/patches/CVE-2021-45944.patch: check stack limits after
function evaluation in psi/zfsample.c.
- CVE-2021-45944
* SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish
- debian/patches/CVE-2021-45949.patch: fix op stack management in
psi/zfsample.c.
- CVE-2021-45949
-- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:22:11 -0500
ghostscript (9.53.3~dfsg-7ubuntu0.2) hirsute-security; urgency=medium
* SECURITY UPDATE: use-after-free in sampled_data_sample
- debian/patches/CVE-2021-45944.patch: check stack limits after
function evaluation in psi/zfsample.c.
- CVE-2021-45944
* SECURITY UPDATE: heap-based buffer overflow in sampled_data_finish
- debian/patches/CVE-2021-45949.patch: fix op stack management in
psi/zfsample.c.
- CVE-2021-45949
-- Marc Deslauriers <email address hidden> Tue, 11 Jan 2022 09:20:41 -0500
ghostscript (9.55.0~dfsg1-0ubuntu4) jammy; urgency=medium * Just mark all libtesseract symbols optional and be done with it. -- Steve Langasek <email address hidden> Tue, 07 Dec 2021 21:21:02 +0000
Available diffs
| Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu3) jammy; urgency=medium
* Mark as optional various symbols which are leaked from the embedded
tesseract library and are not part of the public API, and which are also
arch-specific so causing build failures on non-x86.
-- Steve Langasek <email address hidden> Tue, 07 Dec 2021 20:27:02 +0000
Available diffs
| Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu2) jammy; urgency=medium
* Merge with Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 9.54.0, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
- Updated debian/libgs9.symbols.
Available diffs
| Superseded in jammy-proposed |
ghostscript (9.55.0~dfsg1-0ubuntu1) jammy; urgency=low
* Merge from Debian unstable. Remaining changes:
- New re-packaging of Ghostscript 9.54.0, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
* Updated debian/libgs9.symbols.
-- Till Kamppeter <email address hidden> Mon, 22 Nov 2021 18:24:56 +0100
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.4) focal; urgency=medium
* debian/patches/2021_fix-double-hyphen-option.patch: Fix bug
where using '--' command line syntax fails to read input files
(LP: #1913656)
-- William 'jawn-smith' Wilson <email address hidden> Thu, 14 Oct 2021 15:32:37 -0500
Available diffs
| Superseded in jammy-proposed |
ghostscript (9.54.0~dfsg1-0ubuntu3) jammy; urgency=medium * No-change rebuild against libidn12 -- Steve Langasek <email address hidden> Sun, 07 Nov 2021 05:32:06 +0000
Available diffs
| Superseded in jammy-release |
| Obsolete in impish-release |
| Deleted in impish-proposed (Reason: Moved to impish) |
ghostscript (9.54.0~dfsg1-0ubuntu2) impish; urgency=medium
* SECURITY UPDATE: Trivial -dSAFER bypass
- debian/patches/CVE-2021-3781.patch: include device specifier strings
in access validation in base/gdevpipe.c, base/gp_mshdl.c,
base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c.
- CVE-2021-3781
-- Marc Deslauriers <email address hidden> Fri, 10 Sep 2021 07:59:00 -0400
Available diffs
ghostscript (9.50~dfsg-5ubuntu4.3) focal-security; urgency=medium
* SECURITY UPDATE: Trivial -dSAFER bypass
- debian/patches/CVE-2021-3781-pre1.patch: handle format strings in
pipe OutputFiles in base/gslibctx.c.
- debian/patches/CVE-2021-3781-pre2.patch: fix pdfwrite "%d" mode with
file permissions in base/gsdevice.c, base/gslibctx.c.
- debian/patches/CVE-2021-3781-pre3.patch: move "break" to correct
place in base/gslibctx.c.
- debian/patches/CVE-2021-3781.patch: include device specifier strings
in access validation in base/gdevpipe.c, base/gp_mshdl.c,
base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c.
- CVE-2021-3781
-- Marc Deslauriers <email address hidden> Thu, 09 Sep 2021 09:34:31 -0400
ghostscript (9.53.3~dfsg-7ubuntu0.1) hirsute-security; urgency=medium
* SECURITY UPDATE: Trivial -dSAFER bypass
- debian/patches/CVE-2021-3781.patch: include device specifier strings
in access validation in base/gdevpipe.c, base/gp_mshdl.c,
base/gp_msprn.c, base/gp_os2pr.c, base/gslibctx.c.
- CVE-2021-3781
-- Marc Deslauriers <email address hidden> Thu, 09 Sep 2021 09:00:55 -0400
Available diffs
ghostscript (9.54.0~dfsg1-0ubuntu1) impish; urgency=medium
* New re-packaging of Ghostscript 9.54.0, keeping the leptonica and
tesseract convenience copies in as they are not in Ubuntu Main. Added
appropriate remark to debian/copyright.
* De-activated the extract library/"docxwrite" device. This did not
build and Debian also seems to not use it. Used the --without-extract-dir
option on ./configure for that.
* "Downgrade" dh_missing from --fail-missing to --list-missing to
avoid FTBFS on non-amd64 from compat 13 on
* Updated debian/libgs9.symbols.
-- Till Kamppeter <email address hidden> Thu, 19 Aug 2021 11:54:46 +0200
Available diffs
| Deleted in impish-proposed (Reason: FTBFS, removed at request of ricotz) |
ghostscript (9.54.0~dfsg-1) experimental; urgency=medium
[ upstream ]
* new release
* update copyright info:
+ exclude comvenience copies
of projects libextract, leptonica, and tesseract
+ update coverage
+ update source helper tool copyright-check:
implement option --merge-licenses
* drop patches cherry-picked upstream since applied
* unfuzz patches
* add patches cherry-picked upstream:
+ improve description of configure.ac option --with-extract-dir
+ fix magic number used in pam device
+ fix MacOS/tesseract build problems on Unix systems
+ work with latest Extract library
+ bounds check name table "string"
+ add some relevant flags to the cups compilation
+ do not lie about emitting Multiple Master fonts in psfwrite
+ add a PassThrough for JPX encoded images to pdfwrite
+ fix missing interior of rectangles (regression in 9.54.0)
+ tweak Leptonica/Tesseract memory allocators
* add patch 1004 to enable DeviceN-related device xcfcmyk
* use debhelper compatibility level 13 (not 12)
-- Jonas Smedegaard <email address hidden> Sun, 18 Jul 2021 15:07:19 +0200
| Superseded in impish-release |
| Obsolete in hirsute-release |
| Deleted in hirsute-proposed (Reason: moved to Release) |
ghostscript (9.53.3~dfsg-7) unstable; urgency=medium
* update previous changelog section, add a bug closure.
* update source helper script copyright-check.
* copyright: update coverage
* add patches cherry-picked upstream:
+ re-enable support for opvp/oprp devices;
closes: bug#980971, thanks to Chris Bainbridge
+ parse some types of broken PDFs;
closes: bug#981583, thanks to Rogério Brito
+ fix segfault parsing large Postscript file;
closes: bug#970878, thanks to Paul Gevers, Bernhard Übelacker,
Iustin Pop and Stefano Rivera
* update symbols: 4 private symbols added
-- Jonas Smedegaard <email address hidden> Tue, 02 Feb 2021 14:18:01 +0100
Available diffs
- diff from 9.53.3~dfsg-6 to 9.53.3~dfsg-7 (18.2 KiB)
ghostscript (9.26~dfsg+0-0ubuntu0.16.04.14) xenial-security; urgency=medium
* SECURITY UPDATE: integer overflow in opj_t1_encode_cblks
- debian/patches/CVE-2018-5727.patch: fix UBSAN signed integer overflow
in openjpeg/src/lib/openjp2/t1.c.
- CVE-2018-5727
* SECURITY UPDATE: heap overflow in opj_t1_clbl_decode_processor
- debian/patches/CVE-2020-6851.patch: reject images whose
coordinates are beyond INT_MAX in openjpeg/src/lib/openjp2/j2k.c.
- CVE-2020-6851
* SECURITY UPDATE: another heap overflow in opj_t1_clbl_decode_processor
- debian/patches/CVE-2020-8112.patch: avoid integer overflow in
openjpeg/src/lib/openjp2/tcd.c.
- CVE-2020-8112
* SECURITY UPDATE: heap-buffer-overflow
- debian/patches/CVE-2020-27814-1.patch: grow buffer size in
openjpeg/src/lib/openjp2/tcd.c.
- debian/patches/CVE-2020-27814-2.patch: grow it again
- debian/patches/CVE-2020-27814-3.patch: and some more
- debian/patches/CVE-2020-27814-4.patch: bigger, BIGGER!!!
- CVE-2020-27814
* SECURITY UPDATE: global-buffer-overflow
- debian/patches/CVE-2020-27824.patch: avoid global buffer overflow on
irreversible conversion when too many decomposition levels are
specified in openjpeg/src/lib/openjp2/dwt.c.
- CVE-2020-27824
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27841.patch: add extra checks to
openjpeg/src/lib/openjp2/pi.c, openjpeg/src/lib/openjp2/pi.h,
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27841
* SECURITY UPDATE: null pointer dereference
- debian/patches/CVE-2020-27842.patch: add check to
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27842
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27843.patch: add check to
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27843
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27845.patch: add extra checks to
openjpeg/src/lib/openjp2/pi.c.
- CVE-2020-27845
-- Marc Deslauriers <email address hidden> Wed, 06 Jan 2021 12:44:08 -0500
Available diffs
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.14) bionic-security; urgency=medium
* SECURITY UPDATE: integer overflow in opj_t1_encode_cblks
- debian/patches/CVE-2018-5727.patch: fix UBSAN signed integer overflow
in openjpeg/src/lib/openjp2/t1.c.
- CVE-2018-5727
* SECURITY UPDATE: heap overflow in opj_t1_clbl_decode_processor
- debian/patches/CVE-2020-6851.patch: reject images whose
coordinates are beyond INT_MAX in openjpeg/src/lib/openjp2/j2k.c.
- CVE-2020-6851
* SECURITY UPDATE: another heap overflow in opj_t1_clbl_decode_processor
- debian/patches/CVE-2020-8112.patch: avoid integer overflow in
openjpeg/src/lib/openjp2/tcd.c.
- CVE-2020-8112
* SECURITY UPDATE: heap-buffer-overflow
- debian/patches/CVE-2020-27814-1.patch: grow buffer size in
openjpeg/src/lib/openjp2/tcd.c.
- debian/patches/CVE-2020-27814-2.patch: grow it again
- debian/patches/CVE-2020-27814-3.patch: and some more
- debian/patches/CVE-2020-27814-4.patch: bigger, BIGGER!!!
- CVE-2020-27814
* SECURITY UPDATE: global-buffer-overflow
- debian/patches/CVE-2020-27824.patch: avoid global buffer overflow on
irreversible conversion when too many decomposition levels are
specified in openjpeg/src/lib/openjp2/dwt.c.
- CVE-2020-27824
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27841.patch: add extra checks to
openjpeg/src/lib/openjp2/pi.c, openjpeg/src/lib/openjp2/pi.h,
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27841
* SECURITY UPDATE: null pointer dereference
- debian/patches/CVE-2020-27842.patch: add check to
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27842
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27843.patch: add check to
openjpeg/src/lib/openjp2/t2.c.
- CVE-2020-27843
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2020-27845.patch: add extra checks to
openjpeg/src/lib/openjp2/pi.c.
- CVE-2020-27845
-- Marc Deslauriers <email address hidden> Wed, 06 Jan 2021 12:44:08 -0500
Available diffs
ghostscript (9.53.3~dfsg-6) unstable; urgency=medium
* copyright-check:
+ fix quote path when creating temporary skipfile
+ ignore skipfiles below debian/
+ compute robust file regex from content with regexp-assemble
+ list dependencies in header comment
* add source helper tools
patch-cherry-pick patch-mkseries patch-refresh-all
* copyright:
+ update coverage
+ consistently wrap Files and Copyright paragraphs
(sole exception being initial wildcard Files paragraph)
* add patch cherry-picked upstream,
and patch by Stefano Rivera,
to fix endian issues with CMM;
closes: bug#976177, thanks to Stefano Rivera
* declare compliance with Debian Policy 4.5.1
* update git-buildpackage settings:
+ use DEP-14 git branch names
+ add usage comment
* add patch cherry-picked upstream
to fix linking with libfreetype 2.10.3 and newer
-- Jonas Smedegaard <email address hidden> Wed, 23 Dec 2020 02:51:22 +0100
Available diffs
ghostscript (9.53.3~dfsg-5ubuntu2) hirsute; urgency=medium
* Patch 0003: Revert 278f9a53 "txtwrite - better processing of text in type
3 fonts". Fixing segfault in doc-rfc autopkgtest. (Closes: #970878)
-- Stefano Rivera <email address hidden> Mon, 30 Nov 2020 18:55:30 -0800
Available diffs
| Superseded in hirsute-proposed |
ghostscript (9.53.3~dfsg-5ubuntu1) hirsute; urgency=medium
* Patch 0001, 0002: Fix big-endian CMM-handling bug leading to segfault in
the ocrmypdf autopkgtest. (Closes: #976177)
-- Stefano Rivera <email address hidden> Mon, 30 Nov 2020 16:39:58 -0800
Available diffs
| Superseded in hirsute-proposed |
ghostscript (9.53.3~dfsg-5) unstable; urgency=medium
* simplify build routines slightly
* tighten source script copyright-check
* update copyright hints
* relax tracking of symlinks to fonts-urw-base35
to ignore file contents;
closes: bug#972896, thanks to Fabian Greffrath
-- Jonas Smedegaard <email address hidden> Mon, 26 Oct 2020 11:04:53 +0100
ghostscript (9.26~dfsg+0-0ubuntu0.16.04.13) xenial-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2020-16*.patch: backport multiple upstream commits
to fix various security issues.
- CVE-2020-16287, CVE-2020-16288, CVE-2020-16289, CVE-2020-16290,
CVE-2020-16291, CVE-2020-16292, CVE-2020-16293, CVE-2020-16294,
CVE-2020-16295, CVE-2020-16296, CVE-2020-16297, CVE-2020-16298,
CVE-2020-16299, CVE-2020-16300, CVE-2020-16301, CVE-2020-16302,
CVE-2020-16303, CVE-2020-16304, CVE-2020-16305, CVE-2020-16306,
CVE-2020-16307, CVE-2020-16308, CVE-2020-16309, CVE-2020-16310,
CVE-2020-17538
-- Marc Deslauriers <email address hidden> Fri, 21 Aug 2020 13:16:34 -0400
ghostscript (9.26~dfsg+0-0ubuntu0.18.04.13) bionic-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2020-16*.patch: backport multiple upstream commits
to fix various security issues.
- CVE-2020-16287, CVE-2020-16288, CVE-2020-16289, CVE-2020-16290,
CVE-2020-16291, CVE-2020-16292, CVE-2020-16293, CVE-2020-16294,
CVE-2020-16295, CVE-2020-16296, CVE-2020-16297, CVE-2020-16298,
CVE-2020-16299, CVE-2020-16300, CVE-2020-16301, CVE-2020-16302,
CVE-2020-16303, CVE-2020-16304, CVE-2020-16305, CVE-2020-16306,
CVE-2020-16307, CVE-2020-16308, CVE-2020-16309, CVE-2020-16310,
CVE-2020-17538
-- Marc Deslauriers <email address hidden> Fri, 21 Aug 2020 13:09:58 -0400
| 1 → 75 of 406 results | First • Previous • Next • Last |
