git.ipfire.org Git - thirdparty/openembedded/openembedded-core.git/commit

author	Archana Polampalli <archana.polampalli@windriver.com>
	Tue, 18 Jul 2023 11:34:43 +0000 (11:34 +0000)
committer	Steve Sakoman <steve@sakoman.com>
	Tue, 18 Jul 2023 15:56:44 +0000 (05:56 -1000)
commit	cd3921215cb782ecc9aeda5bb3b76863911bcb61
tree	17e6cf25f712d0b9b89a22e9293a266e977538a8	tree \| snapshot
parent	aae5bf06ad3c67386544f9da55aa21fbf32c3418	commit \| diff

ghostscript: fix CVE-2023-36664

Artifex Ghostscript through 10.01.2 mishandles permission validation for
pipe devices (with the %pipe% prefix or the | pipe character prefix).

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-36664

Upstream patches:
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=5e65eeae225c7d02d447de5abaf4a8e6d234fcea
https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=fb342fdb60391073a69147cb71af1ac416a81099

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0001.patch	[new file with mode: 0644]	blob
meta/recipes-extended/ghostscript/ghostscript/CVE-2023-36664-0002.patch	[new file with mode: 0644]	blob
meta/recipes-extended/ghostscript/ghostscript_9.55.0.bb		diff \| blob \| blame \| history