Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
Name: ghostscript-devel | Distribution: openSUSE Tumbleweed |
Version: 10.03.1 | Vendor: openSUSE |
Release: 1.1 | Build date: Mon Jul 1 13:56:34 2024 |
Group: Development/Libraries/C and C++ | Build host: reproducible |
Size: 62857 | Source RPM: ghostscript-10.03.1-1.1.src.rpm |
Packager: http://bugs.opensuse.org | |
Url: https://www.ghostscript.com/ | |
Summary: Development files for Ghostscript |
This package contains the development files for Ghostscript.
AGPL-3.0-only
* Mon Jul 01 2024 Johannes Meixner <jsmeix@suse.com> - Version upgrade to 10.03.1: Highlights in this release include: See 'Recent Changes in Ghostscript' at Ghostscript upstream https://ghostscript.readthedocs.io/en/gs10.03.1/News.html * Fixes for CVE-2024-33869, CVE-2023-52722, CVE-2024-33870, CVE-2024-33871 and CVE-2024-29510 - Regarding CVE-2024-33869 see bsc#1226946 and https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43 https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4 https://bugs.ghostscript.com/show_bug.cgi?id=707691 - Regarding CVE-2023-52722 see bsc#1223852 and https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=afd7188f74918cb51b5fb89f52b54eb16e8acfd1 - Regarding CVE-2024-33870 see bsc#1226944 and https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984dc3da2dc090450407d9fbcff80 https://bugs.ghostscript.com/show_bug.cgi?id=707686 - Regarding CVE-2024-33871 see bsc#1225491 and https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908 - Regarding CVE-2024-29510 see bsc#1226945 and https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=3b1735085ecef20b29e8db3416ab36de93e86d1f * Tue Mar 26 2024 Johannes Meixner <jsmeix@suse.com> - Version upgrade to 10.03.0: For openSUSE and SUSE Ghostscript is built '--without-tesseract' (see the entry below dated 'Mon Jul 18 07:28:54 UTC 2022'). Highlights in this release include: See 'Recent Changes in Ghostscript' at Ghostscript upstream https://ghostscript.readthedocs.io/en/gs10.03.0/News.html * As of this release (10.03.0) pdfwrite creates PDF files with XRef streams and ObjStm streams. This can result in considerably smaller PDF output files. See Vector Devices https://ghostscript.readthedocs.io/en/latest/VectorDevices.html for more details. * Ghostscript/pdfwrite now supports passing through PDF "Optional Content". * Our efforts in code hygiene and maintainability continue. * The usual round of bug fixes, compatibility changes, and incremental improvements. Incompatible changes (the release is listed in parentheses): * (10.03.0) Almost all the "internal" PostScript procedures defined during the interpreter startup are now "executeonly", further reducing the attack surface of the interpreter. The nature of these procedures means there should be no impact for legitimate usage, but it is possible it will impact uses which abuse the previous accessibility (even for legitimate reasons). Such cases may now require "DELAYBIND", See DELAYBIND https://ghostscript.readthedocs.io/en/latest/Use.html#ddelaybind * (10.03.0) The "makeimagedevice" non-standard operator has been removed. It allowed low level access to the graphics library in a way that was, essentially impossible to secure. * (10.03.0) The "putdeviceprops", "getdeviceprops", "finddevice", "copydevice", "findprotodevice" non-standard operators have all been removed. They provided functionality that is either accessible through standard operators, or should not be used by user PostScript. * (10.03.0) The process of "tidying" the PostScript namespace should have removed only non-standard and undocumented operators. Nevertheless, it is possible that any integrations or utilities that rely on those non-standard and undocumented operators may stop working or may change behaviour. If you encounter such a case, please contact us (Discord https://discord.gg/H9GXKwyPvY [#]ghostscript IRC channel https://web.libera.chat/#ghostscript or the gs-devel mailing list https://www.ghostscript.com/mailman/index.html would be best), but remember that free versions of Ghostscript come with with NO WARRANTY and NO SUPPORT. - Ghostscript 10.03.0 contains the fix to build with GCC 14 (boo#1221687) * Tue Feb 27 2024 Dominique Leuenberger <dimstar@opensuse.org> - Use %patch -P N instead of deprecated %patchN. * Thu Feb 22 2024 Thorsten Kukuk <kukuk@suse.com> - Allow to disable apparmor support (ALP supports only SELinux) * Sun Jan 28 2024 Dirk Müller <dmueller@suse.com> - update to 10.02.1: * Patch release to address some security bugs * This release (10.02.0) marks the final demise of the PostScript based PDF interpreter. * This 10.01.1 release removes the "-dNEWPDF=false" command line option to fall back to the deprecated, old PDF interpreter. * This 10.01.0 release removes the "-dNEWPDF=false" command line option to fall back to the deprecated, old PDF interpreter. * This release officially deprecates the old Postscript implementation of PDF, we will not be updating or maintaining that code moving forward. The option to use the old PDF implementation _**will**_ be removed in the next full release (10.01.0) * Important: This release includes the new PDF interpreter (implemented in C rather than PostScript). It is both integrated into Ghostscript (now ENABLED by default), and available as a standalone, PDF only, binary. See https://ghostscript.com/pdfi.html for more details. * This also bundles the latest zlib (1.2.12) which addresses a security issue (CVE-2018-25032) * **Important**: This release includes the new PDF interpreter (implemented in C rather than PostScript). It is both integrated into Ghostscript (now **ENABLED** by default), and available as a standalone, PDF only, binary. See https://ghostscript.com/pdfi.html for more details. - drop CVE-2023-28879.patch, CVE-2023-36664.patch, CVE-2023-38559.patch, CVE-2023-43115.patch, CVE-2023-46751.patch: upstream - drop remove-zlib-h-dependency.patch: unused * Wed Jan 03 2024 Johannes Meixner <jsmeix@suse.com> - CVE-2023-46751.patch is https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13 adapted for Ghostscript-9.56.1 that fixes https://bugs.ghostscript.com/show_bug.cgi?id=707264 which includes a fix for CVE-2023-46751 "dangling pointer in gdev_prn_open_printer_seekable()" (bsc#1217871) * Mon Dec 18 2023 Dominique Leuenberger <dimstar@opensuse.org> - Recommend cups-filters only when cups is present. * Wed Sep 20 2023 Johannes Meixner <jsmeix@suse.com> - CVE-2023-43115.patch is https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e59216049cac290fb437a04c4f41ea46826cfba5 that fixes CVE-2023-43115 "remote code execution via crafted PostScript documents in gdevijs.c" see https://bugs.ghostscript.com/show_bug.cgi?id=707051 (bsc#1215466) * Wed Jul 26 2023 Johannes Meixner <jsmeix@suse.com> - CVE-2023-38559.patch fixes CVE-2023-38559 "out of bounds read devn_pcx_write_rle() could result in DoS" see bsc#1213637 and https://bugs.ghostscript.com/show_bug.cgi?id=706897 which is in base/gdevdevn.c the same issue "ordering in if expression to avoid out-of-bounds access" as the already fixed CVE-2020-16305 in devices/gdevpcx.c see https://bugs.ghostscript.com/show_bug.cgi?id=701819 * Tue Jul 04 2023 Johannes Meixner <jsmeix@suse.com> - CVE-2023-36664.patch fixes CVE-2023-36664 see https://bugs.ghostscript.com/show_bug.cgi?id=706761 "OS command injection in %pipe% access" and https://bugs.ghostscript.com/show_bug.cgi?id=706778 "%pipe% allowed_path bypass" and bsc#1212711 "permission validation mishandling for pipe devices (with the %pipe% prefix or the | pipe character prefix)" * Wed Apr 26 2023 Jan Engelhardt <jengelh@inai.de> - Replace BuildRequire on xorg-x11-devel by pkgconfig(...) * Tue Apr 11 2023 Johannes Meixner <jsmeix@suse.com> - CVE-2023-28879.patch fixes CVE-2023-28879 Buffer Overflow in s_xBCPE_process cf. https://bugs.ghostscript.com/show_bug.cgi?id=706494 (bsc#1210062) * Mon Jul 18 2022 Dirk Müller <dmueller@suse.com> - update to 9.56.1: Highlights in this release include (excerpts from the Ghostscript upstream release summary in https://ghostscript.com/docs/9.56.1/News.htm): * New PDF Interpreter: This is an entirely new implementation written in C (rather than PostScript, as before) * Calling Ghostscript via the GS API is now thread safe. The one limitation is that the X11 devices for Unix-like systems (x11, x11alpha, x11cmyk, x11cmyk2, x11cmyk4, x11cmyk8, x11gray2, x11gray4 and x11mono) cannot be made thread safe, due to their interaction with the X11 server, those devices have been modified to only allow one instance in an executable. * The PSD output device now writes ICC profiles to their output files, for improved color fidelity. * Our efforts in code hygiene and maintainability continue. * The usual round of bug fixes, compatibility changes, and incremental improvements. * We have added the capability to build with the Tesseract OCR engine. In such a build, new devices are available (pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR that image, and output the image "wrapped" up as a PDF file, with the OCR generated text information included as "invisible" text (in PDF terms, text rendering mode 3). Mainly due to time constraints, we only support including Tesseract from source included in our release packages, and not linking to Tesseract/Leptonica shared libraries. Whether we add this capability will be largely dependent on community demand for the feature. See Enabling OCR at https://www.ghostscript.com/ocr.html for more details. For a release summary see: https://www.ghostscript.com/doc/9.54.0/News.htm For details see the News.htm and History9.htm files. - Configure --without-tesseract because this requires C++ (it might be added if Tesseract support in Ghostscript is needed). - Drop CVE-2021-3781.patch, CVE-2021-45949.patch: upstream * Mon Jul 18 2022 Dirk Müller <dmueller@suse.com> - Use _multibuild * Wed Apr 13 2022 Dirk Müller <dmueller@suse.com> - Use system zlib (bsc#1198449) * Thu Apr 07 2022 Frederic Crozat <fcrozat@suse.com> - Do no longer require apparmor-abstractions, it is not mandatory to use Ghostscript (bsc#1134289). * Tue Jan 11 2022 jsmeix@suse.de - CVE-2021-45949.patch fixes CVE-2021-45949 heap-based buffer overflow in sampled_data_finish cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml (bsc#1194304) - CVE-2021-45944 use-after-free in sampled_data_sample is already fixed in the Ghostscript 9.54.0 upstream sources (bsc#1194303) * Fri Sep 10 2021 jsmeix@suse.de - CVE-2021-3781.patch fixes CVE-2021-3781 Trivial -dSAFER bypass cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342 (bsc#1190381) * Fri May 21 2021 jsmeix@suse.de - Version upgrade to 9.54.0 Highlights in this release include (excerpts from the Ghostscript upstream release summary in https://www.ghostscript.com/doc/9.54.0/News.htm): * The 9.54.0 release is a maintenance release, and also adds new functionality. * Overprint simulation is now available to all output devices, allowing quality previewing/proofing of PostScript and PDF jobs that rely on overprint. See the -dOverprint option documentation in: doc/9.54.0/Use.htm#Overprint * The "docxwrite" device adds the ability to output to Microsoft Word "docx" format. See: doc/9.54.0/VectorDevices.htm#DOCX * The pdfwrite device is now capable of using the Tesseract OCR engine when it is built into Ghostscript to improve searchability and copy and paste functionality when the input lacks the metadata for that purpose. See: doc/9.54.0/VectorDevices.htm#UseOCR * Ghostscript/GhostPDL now includes a "map text to black" function, where text drawn by an input job (except when drawn using a Type 3 font) can be forced to draw in solid black. See: doc/9.54.0/Use.htm#BlackText * Ghostscript/GhostPDL now supports simple N-up imposition "internally". See: doc/9.54.0/Use.htm#NupControl * Our efforts in code hygiene and maintainability continue. * The usual round of bug fixes, compatibility changes, and incremental improvements. * For a list of open issues, or to report problems, please visit bugs.ghostscript.com For a release summary see: https://www.ghostscript.com/doc/9.54.0/News.htm For details see the News.htm and History9.htm files. - 41ef9a0bc36b9db7115fbe9623f989bfb47bbade.patch is no longer needed because it is fixed in the upstream sources. * Wed Apr 14 2021 Wolfgang Frisch <wolfgang.frisch@suse.com> - Hardening: compile with PIC, link as PIE
/usr/include/ghostscript /usr/include/ghostscript/gdevdsp.h /usr/include/ghostscript/gserrors.h /usr/include/ghostscript/iapi.h /usr/include/ghostscript/ierrors.h /usr/include/ijs /usr/include/ijs/ijs.h /usr/include/ijs/ijs_client.h /usr/include/ijs/ijs_server.h /usr/lib64/libgs.so /usr/lib64/libijs.so /usr/lib64/pkgconfig/ijs.pc
Generated by rpm2html 1.8.1
Fabrice Bellet, Thu Sep 12 00:45:33 2024