summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/ghostscript
AgeCommit message (Collapse)Author
2024-04-16ghostscript: upgrade 10.02.1 -> 10.03.0Wang Mingyu
avoid-host-contamination.patch refreshed for 10.03.0 configure.ac-add-option-to-explicitly-disable-neon.patch removed since it's included in 10.03.0 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-24meta: Update CVE_STATUS for incorrect cpesSimone Weiß
Set CVE_STATUS as none of the issues apply against the versions used in the recipes. Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-02-08ghostscript: correct LICENSE with AGPLv3Kai Kang
The license of ghostscript has switched to Affero GPL since version 9.07 via commit: * 3cc5318 Switch Ghostscript/GhostPDL to Affero GPL https://github.com/ArtifexSoftware/ghostpdl/commit/3cc5318 Correct it with `AGPL-3.0-or-later`. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-11-13ghostscript: Build and install shared libMarkus Volk
libgs is eg. needed to build ghostscript support for gimp also install the data target Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-11-05ghostscript: upgrade 10.02.0 -> 10.02.1Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-09-26ghostscript: upgrade 10.01.2 -> 10.02.0Alexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-05ghostscript: avoid neon on unsupported machinesBenjamin Bara
Disable neon if the machine does not support it. Signed-off-by: Benjamin Bara <benjamin.bara@skidata.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-09ghostscript: ignore CVE-2023-38560Ross Burton
The ghostscript recipe isn't vulnerable to CVE-2023-38560, as this is an issue in the GhostPCL release, whereas this recipe is the Ghostscript release. Signed-off-by: Ross Burton <ross.burton@arm.com>
2023-08-09ghostscript: backport fix for CVE-2023-38559Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com>
2023-07-14ghostscript: advance to version 10.01.2Joe Slater
Fix CVE-2023-28879 and CVE-2023-36664. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-29ghostscript: remove CVE_CHECK_IGNORE for CVE-2013-6629Ross Burton
This CVE now has a version range, indicating that this Ghostscript release isn't vulnerable. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-20ghostscript: mostly rewrite recipeRoss Burton
This started as a patch cleanup but escalated rapidly. Remove unneeded patches: - mkdir-p.patch isn't needed now the Makefiles appear to have the correct dependencies. - ghostscript-9.15-parallel-make.patch appears to be unneeded for the same reason - base-genht.c-add-a-preprocessor-define-to-allow-fope.patch isn't needed - cups-no-gcrypt.patch isn't needed - do-not-check-local-libpng-source.patch can be replaced by deleting the libpng/ directory, as is already done for jpeg/ - ghostscript-9.21-native-fix-disable-system-libtiff.patch is not needed when we stop doing native builds (see below) Remove the need for ghostscript-native to build and install tools that are needed at target build-time: ghostscript can do this itself. Remove the BBCLASSEXTEND and all of the native overrides. Inherit pkgconfig and explicitly tell configure to use the pkgconfig binary: unless told otherwise this configure will refuse to use an unprefixed pkgconfig in cross builds. Review DEPENDS and add missing freetype and zlib dependencies. Ghostcript will use the embedded copies of libraries over system libraries, so extend the deletion of jpeg and libpng to include expat, freetype, and cups as we want to link to our build of those. We can't delete zlib as it is explicitly used when building the native tools. Add PACKAGECONFIGs for optional libidn and libpaper dependencies. Remove HAVE_SYS_TIME_H assignments, the upstream bug was fixed in 2011. Clean up comments: there's no need to explain how to use PACKAGECONFIG, and justify the use of autotools-brokensep. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-06ghostscript: upgrade to 10.01.1Ross Burton
Drop the merged fix for CVE-2023-28879. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-05-05ghostscript: fix CVE-2023-28879Joe Slater
Backport from tag ghostpdl-10.01.1-gse-10174 which is after 10.01.1. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-18ghostscript: update 9.56.1 -> 10.0.0Alexander Kanavin
Drop --without-jbig2dec as it is now required by pdf support and jbig2dec library is in ghostscript's source tree. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-09-02ghostscript: remove unneeded patchAlexander Kanavin
The patch has been added here https://git.yoctoproject.org/poky/commit/?id=ca63a0158ae42010477080ad6bb776329f1230b0 and isn't necessary anymore, as cross compilation works fine without it. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-04-19ghostscript: upgrade 9.55.0 -> 9.56.1wangmy
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21meta/scripts: Automated conversion of OE renamed variablesRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-20meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX ↵Richard Purdie
license identifiers An automated conversion using scripts/contrib/convert-spdx-licenses.py to convert to use the standard SPDX license identifiers. Two recipes in meta-selftest were not converted as they're that way specifically for testing. A change in linux-firmware was also skipped and may need a more manual tweak. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-23ghostscript: update 9.54.0 -> 9.55.0Alexander Kanavin
jbig2dec seems no longer optional; the source for it is bundle with ghostscript. License-Update: removed patent references Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30Convert to new override syntaxRichard Purdie
This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-12ghostscript: Exclude CVE-2013-6629 from cve-checkRichard Purdie
The CVE is in the jpeg sources included with ghostscript. We use our own external jpeg library so this doesn't affect us. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-04-18ghostscript: upgrade 9.53.3 -> 9.54.0wangmy
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-10-30ghostscript: update 9.52 -> 9.53.3Alexander Kanavin
ghostscript-9.15-parallel-make.patch rebased; one of the chunks removed upstream. Remove bundled jpeg source, as that seems to be the only way to get ghostscript to fall back to system jpeg library. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-08-08ghostscript: fix CVE-2020-15900Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-18ghostscript: Remove leftover fileRichard Purdie
This should have been removed in a previous change but was accidentally left behind and points at an invalid directory. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-03ghostscript: update 9.50 -> 9.52Alexander Kanavin
Drop all custom objarch.h files; ghostscript nowadays generates that with autoconf. Freetype can no longer be disabled. Building out of source tree is broken. Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-05-03ghostscript: do not hardcode version in SRC_URIAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-02-06microblaze: Adjust Linux items from microblazeeb to microblazeMark Hatle
Due to recent changes to the tune, in order to match config.guess, the name of the big-endian microblaze architecture was changes to 'microblaze'. Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2020-01-19ghostscript: Add powerpc64 LE specific objarch.hKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-12-09ghostscript: upgrade 9.27 -> 9.50Trevor Gamblin
Version 9.50 incorporates previously-backported fixes for CVE-2019-14811 and CVE-2019-14817. CVE: CVE-2019-14811 CVE: CVE-2019-14817 Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-11-29ghostscript: fix for CVE-2019-14811 is same as CVE-2019-14813Anuj Mittal
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14813 https://www.openwall.com/lists/oss-security/2019/08/28/2 Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-11-25ghostscript: CVE-2019-14869Stefan Ghinea
A flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges within the Ghostscript and access files outside of restricted areas or execute commands. References: https://nvd.nist.gov/vuln/detail/CVE-2019-14869 Upstream patches: https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-10-08ghostscript: Disable libpaperKhem Raj
OE does not provide libpaper recipe, and the configure check looks for libpaper if not disabled, this causes problems especially when shared state is built on a machine which has libpaper installed on host but the consumer machine although running same OS, but does not have libpaper installed, the artifact from sstate are re-used but then native binary ./obj/aux/packps fails to execute ./obj/aux/packps: error while loading shared libraries: libpaper.so.1: cannot open shared object file: No such file or directory So either we need to provide libpaper in OE or we disable it, disabling is best for now Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-15ghostscript: CVE-2019-14811, CVE-2019-14817Stefan Ghinea
A flaw was found in, ghostscript versions prior to 9.28, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. A flaw was found in, ghostscript versions prior to 9.28, in the .pdfexectoken and other procedures where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. A specially crafted PostScript file could disable security protection and then have access to the file system, or execute arbitrary commands. References: https://nvd.nist.gov/vuln/detail/CVE-2019-14811 https://nvd.nist.gov/vuln/detail/CVE-2019-14817 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc42787ecb76686c8ee4dd33bf33 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e291efe611979bdc1b3bdb19 Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2019-05-12ghostscript: 9.26 -> 9.27Hongxu Jia
- Rebase ghostscript-9.02-genarch.patch - Drop backported CVE patches Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-05-08ghostscript: set CVE_PRODUCTChen Qi
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-04-09ghostscript: Fix 3 CVEsOvidiu Panait
It was discovered that the ghostscript /invalidaccess checks fail under certain conditions. An attacker could possibly exploit this to bypass the -dSAFER protection and, for example, execute arbitrary shell commands via a specially crafted PostScript document. It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER. References: https://nvd.nist.gov/vuln/detail/CVE-2019-6116 https://www.openwall.com/lists/oss-security/2019/01/23/5 https://nvd.nist.gov/vuln/detail/CVE-2019-3835 https://nvd.nist.gov/vuln/detail/CVE-2019-3838 Upstream patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=13b0a36 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2db98f9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=99f1309 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=59d8f4d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2768d1a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=49c8092 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2ff600a http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=779664d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=e8acf6d http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=2055917 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=d683d1e http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ed9fcd9 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=a82601e Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-12-01ghostscript: 9.25 -> 9.26Hongxu Jia
- Drop backported CVE fixes 000[1-8]*.patch Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06ghostscript: fix CVE-2018-18284Hongxu Jia
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06ghostscript: fix CVE-2018-18073Hongxu Jia
Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06ghostscript: fix CVE-2018-17961Hongxu Jia
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-20ghostscript: upgrade to 9.25Jagadeesh Krishnanjanappa
Removed below patches, as v9.25 source already has those changes/security fixes: 0001-Bug-699665-memory-corruption-in-aesdecode.patch 0001-pdfwrite-Guard-against-trying-to-output-an-infinite-.patch 0002-Bug-699656-Handle-LockDistillerParams-not-being-a-bo.patch 0003-Fix-Bug-699660-shading_param-incomplete-type-checkin.patch 0004-Hide-the-.shfill-operator.patch 0005-Bug-699657-properly-apply-file-permissions-to-.tempf.patch remove-direct-symlink.patch Re-worked ghostscript-9.21-native-fix-disable-system-libtiff.patch and ghostscript-9.21-prevent_recompiling.patch to fix warnings in do_patch task of ghostscript v9.25 recipe. Highlights of ghostscript v9.25 release: --------------------------------------- - This release fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files), and some additional security issues over the recent 9.24 release. - Note: The ps2epsi utility does not, and cannot call Ghostscript with the -dSAFER command line option. It should never be called with input from untrusted sources. - Security issues have been the primary focus of this release, including solving several (well publicised) real and potential exploits. - As well as Ghostscript itself, jbig2dec has had a significant amount of work improving its robustness in the face of out specification files. - IMPORTANT: We are in the process of forking LittleCMS. LCMS2 is not thread safe, and cannot be made thread safe without breaking the ABI. Our fork will be thread safe, and include performance enhancements (these changes have all be been offered and rejected upstream). We will maintain compatibility between Ghostscript and LCMS2 for a time, but not in perpetuity. Our fork will be available as its own package separately from Ghostscript (and MuPDF). - The usual round of bug fixes, compatibility changes, and incremental improvements. Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-11ghostscript: fix CVE-2018-15908 & CVE-2018-15909 & CVE-2018-15910 & ↵Hongxu Jia
CVE-2018-15911 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-03ghostscript: fix CVE-2018-10194Hongxu Jia
https://nvd.nist.gov/vuln/detail/CVE-2018-10194 Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-04ghostscript: 9.21 -> 9.23Hongxu Jia
1. Drop backported patches - CVE-2017-7207.patch - CVE-2017-5951.patch - CVE-2017-7975.patch - CVE-2017-9216.patch - CVE-2017-9611.patch - CVE-2017-9612.patch - CVE-2017-9739.patch - CVE-2017-9726.patch - CVE-2017-9727.patch - CVE-2017-9835.patch - CVE-2017-11714.patch 2. Rebase to 9.23 - ghostscript-9.15-parallel-make.patch - ghostscript-9.16-Werror-return-type.patch - do-not-check-local-libpng-source.patch - avoid-host-contamination.patch - mkdir-p.patch - ghostscript-9.21-prevent_recompiling.patch - ghostscript-9.02-genarch.patch - cups-no-gcrypt.patch - ghostscript-9.21-native-fix-disable-system-libtiff.patch - base-genht.c-add-a-preprocessor-define-to-allow-fope.patch 3. Add packps from (native to target) to support cross compiling. 4. Add remove-direct-symlink.patch to fix do_populate_sysroot failure Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-03-09ghostscript: drop incorrectly applied patchAlexander Kanavin
The patch was adding a change to the source file that was already there, so the lines of code were repeated twice. This didn't create a bug or a security issue, but it may well have. Long story: https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450 Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-09ghostscript: refresh patchesRoss Burton
The patch tool will apply patches by default with "fuzz", which is where if the hunk context isn't present but what is there is close enough, it will force the patch in. Whilst this is useful when there's just whitespace changes, when applied to source it is possible for a patch applied with fuzz to produce broken code which still compiles (see #10450). This is obviously bad. We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For that to be realistic the existing patches with fuzz need to be rebased and reviewed. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-23ghostscript: CVE-2017-9727, -9835, -11714Joe Slater
CVE-2017-9727: make bounds check in gx_ttfReader__Read more robust CVE-2017-9835: bounds check the array allocations methods CVE-2017-11714: prevent trying to reloc a freed object Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-08-23ghostscript: fix several CVEs by adding bounds checkingJoe Slater
CVE-2017-9611 CVE-2017-9612 CVE-2017-9739 CVE-2017-9726 Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-07 20:50:55 +0000