ghostscript: 9.24 -> 9.25 #47948
Merged
ghostscript: 9.24 -> 9.25 #47948
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Highlights in this release include: This release fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files), and some additional security issues over the recent 9.24 release. CVE-2018-16802 CVE-2018-17183 Note: The ps2epsi utility does not, and cannot call Ghostscript with the -dSAFER command line option. It should never be called with input from untrusted sources. Security issues have been the primary focus of this release, including solving several (well publicised) real and potential exploits. PLEASE NOTE: We strongly urge users to upgrade to this latest release to avoid these issues. As well as Ghostscript itself, jbig2dec has had a significant amount of work improving its robustness in the face of out specification files. IMPORTANT: We are in the process of forking LittleCMS. LCMS2 is not thread safe, and cannot be made thread safe without breaking the ABI. Our fork will be thread safe, and include performance enhancements (these changes have all be been offered and rejected upstream). We will maintain compatibility between Ghostscript and LCMS2 for a time, but not in perpetuity. Our fork will be available as its own package separately from Ghostscript (and MuPDF). The usual round of bug fixes, compatibility changes, and incremental improvements. (cherry picked from commit 5b77b0d)
|
Success on x86_64-linux (full log) Attempted: ghostscript Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: ghostscript Partial log (click to expand)
|
|
Success on x86_64-darwin (full log) Attempted: ghostscript Partial log (click to expand)
|
|
@GrahamcOfBorg test printing |
|
Success on aarch64-linux (full log) Attempted: tests.printing Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: tests.printing Partial log (click to expand)
|
xeji
pushed a commit
that referenced
this pull request
Oct 6, 2018
Highlights in this release include: This release fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files), and some additional security issues over the recent 9.24 release. CVE-2018-16802 CVE-2018-17183 Note: The ps2epsi utility does not, and cannot call Ghostscript with the -dSAFER command line option. It should never be called with input from untrusted sources. Security issues have been the primary focus of this release, including solving several (well publicised) real and potential exploits. PLEASE NOTE: We strongly urge users to upgrade to this latest release to avoid these issues. As well as Ghostscript itself, jbig2dec has had a significant amount of work improving its robustness in the face of out specification files. IMPORTANT: We are in the process of forking LittleCMS. LCMS2 is not thread safe, and cannot be made thread safe without breaking the ABI. Our fork will be thread safe, and include performance enhancements (these changes have all be been offered and rejected upstream). We will maintain compatibility between Ghostscript and LCMS2 for a time, but not in perpetuity. Our fork will be available as its own package separately from Ghostscript (and MuPDF). The usual round of bug fixes, compatibility changes, and incremental improvements. (cherry picked from commit 5b77b0d) (cherry picked from commit dbcbf7c)
|
18.03 backport in 54a2076 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport of #47934 from
mastertorelease-18.09(merged with #47903 and #47946). Please backport to 18.03 as well.Changelog
CVE-2018-16802
CVE-2018-17183
(cherry picked from commit 5b77b0d)
cc @xeji
Things done
sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)nix path-info -Sbefore and after)