package/ghostscript: add upstream security patch for CVE-2021-3781
authorPeter Korsgaard <peter@korsgaard.com>
Tue, 21 Sep 2021 19:16:50 +0000 (21:16 +0200)
committerArnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Wed, 22 Sep 2021 19:20:30 +0000 (21:20 +0200)
commit4e415b4164551e712643e9608d8813cc749fd279
tree221855dd5b9083122f2bcc9fba9db405a90abb75
parent5bb9d79f276551c8fb7a774d8c7bd0f47a9e9809
package/ghostscript: add upstream security patch for CVE-2021-3781

The file access protection built into Ghostscript proved insufficient for
the "%pipe%" PostScript device, when combined with Ghostscript's requirement
to be able to create and control temporary files in the conventional
temporary file directories (for example, "/tmp" or "/temp).  This exploit is
restricted to Unix-like systems (i.e., it doesn't affect Windows).  The most
severe claimed results are only feasible if the exploit is run as a "high
privilege" user (root/superuser level) \u2013 a practice we would discourage
under any circumstances.

For more details, see the advisory:
https://ghostscript.com/CVE-2021-3781.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
package/ghostscript/0002-Bug-704342-Include-device-specifier-strings-in-acces.patch [new file with mode: 0644]
package/ghostscript/ghostscript.mk