1
0
mirror of https://git.yoctoproject.org/poky synced 2026-07-27 07:27:12 +00:00

ghostscript: fix CVE-2021-45949

Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish
(called from sampled_data_continue and interp).

To apply this CVE-2021-45959 patch,
the check-stack-limits-after-function-evalution.patch should be applied first.

References:
https://nvd.nist.gov/vuln/detail/CVE-2021-45949

(From OE-Core rev: 5fb43ed64ae32abe4488f2eb37c1b82f97f83db0)

Signed-off-by: Minjae Kim <flowergom@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Minjae Kim
2022-01-28 08:54:45 +00:00
committed by Richard Purdie
parent 9959bee1af
commit b03d18892c
3 changed files with 118 additions and 0 deletions
@@ -39,6 +39,8 @@ SRC_URI = "${SRC_URI_BASE} \
file://ghostscript-9.21-prevent_recompiling.patch \
file://cups-no-gcrypt.patch \
file://CVE-2020-15900.patch \
file://check-stack-limits-after-function-evalution.patch \
file://CVE-2021-45949.patch \
"
SRC_URI_class-native = "${SRC_URI_BASE} \