mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 07:51:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/ghostscript: add upstream security patch for CVE-2021-3781

Browse Source 
The file access protection built into Ghostscript proved insufficient for
the "%pipe%" PostScript device, when combined with Ghostscript's requirement
to be able to create and control temporary files in the conventional
temporary file directories (for example, "/tmp" or "/temp).  This exploit is
restricted to Unix-like systems (i.e., it doesn't affect Windows).  The most
severe claimed results are only feasible if the exploit is run as a "high
privilege" user (root/superuser level) \u2013 a practice we would discourage
under any circumstances.

For more details, see the advisory:
https://ghostscript.com/CVE-2021-3781.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
This commit is contained in:
Peter Korsgaard
2021-09-21 21:16:50 +02:00
committed by Arnout Vandecappelle (Essensium/Mind)
parent 5bb9d79f27
commit 4e415b4164
2 changed files with 237 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
package/ghostscript/ghostscript.mk
View File

@@ -21,6 +21,9 @@ GHOSTSCRIPT_DEPENDENCIES = \
libpng \
tiff
# 0002-Bug-704342-Include-device-specifier-strings-in-acces.patch
GHOSTSCRIPT_IGNORE_CVES += CVE-2021-3781
# Ghostscript includes (old) copies of several libraries, delete them.
# Inspired by linuxfromscratch:
# http://www.linuxfromscratch.org/blfs/view/svn/pst/gs.html