Index index by Group index by Distribution index by Vendor index by creation date index by Name Mirrors Help Search

ghostscript-devel-10.03.1-1.1 RPM for riscv64

From OpenSuSE Ports Tumbleweed for riscv64

Name: ghostscript-devel Distribution: openSUSE Tumbleweed
Version: 10.03.1 Vendor: openSUSE
Release: 1.1 Build date: Mon Jul 1 13:56:34 2024
Group: Development/Libraries/C and C++ Build host: reproducible
Size: 62857 Source RPM: ghostscript-10.03.1-1.1.src.rpm
Packager: https://bugs.opensuse.org
Url: https://www.ghostscript.com/
Summary: Development files for Ghostscript
This package contains the development files for Ghostscript.

Provides

Requires

License

AGPL-3.0-only

Changelog

* Mon Jul 01 2024 Johannes Meixner <jsmeix@suse.com>
  - Version upgrade to 10.03.1:
    Highlights in this release include:
    See 'Recent Changes in Ghostscript' at Ghostscript upstream
    https://ghostscript.readthedocs.io/en/gs10.03.1/News.html
    * Fixes for CVE-2024-33869, CVE-2023-52722, CVE-2024-33870,
      CVE-2024-33871 and CVE-2024-29510
  - Regarding CVE-2024-33869 see bsc#1226946 and
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=5ae2e320d69a7d0973011796bd388cd5befa1a43
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f5336e5b4154f515ac83bc5b9eba94302e6618d4
    https://bugs.ghostscript.com/show_bug.cgi?id=707691
  - Regarding CVE-2023-52722 see bsc#1223852 and
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=afd7188f74918cb51b5fb89f52b54eb16e8acfd1
  - Regarding CVE-2024-33870 see bsc#1226944 and
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=79aef19c685984dc3da2dc090450407d9fbcff80
    https://bugs.ghostscript.com/show_bug.cgi?id=707686
  - Regarding CVE-2024-33871 see bsc#1225491 and
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7145885041bb52cc23964f0aa2aec1b1c82b5908
  - Regarding CVE-2024-29510 see bsc#1226945 and
    https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=3b1735085ecef20b29e8db3416ab36de93e86d1f
* Tue Mar 26 2024 Johannes Meixner <jsmeix@suse.com>
  - Version upgrade to 10.03.0:
    For openSUSE and SUSE Ghostscript is built '--without-tesseract'
    (see the entry below dated 'Mon Jul 18 07:28:54 UTC 2022').
    Highlights in this release include:
    See 'Recent Changes in Ghostscript' at Ghostscript upstream
    https://ghostscript.readthedocs.io/en/gs10.03.0/News.html
    * As of this release (10.03.0) pdfwrite creates PDF files
      with XRef streams and ObjStm streams. This can result in
      considerably smaller PDF output files. See Vector Devices
      https://ghostscript.readthedocs.io/en/latest/VectorDevices.html
      for more details.
    * Ghostscript/pdfwrite now supports passing through
      PDF "Optional Content".
    * Our efforts in code hygiene and maintainability continue.
    * The usual round of bug fixes, compatibility changes,
      and incremental improvements.
    Incompatible changes (the release is listed in parentheses):
    * (10.03.0) Almost all the "internal" PostScript procedures
      defined during the interpreter startup are now "executeonly",
      further reducing the attack surface of the interpreter.
      The nature of these procedures means there should be no impact
      for legitimate usage, but it is possible it will impact uses
      which abuse the previous accessibility (even for legitimate
      reasons). Such cases may now require "DELAYBIND", See DELAYBIND
      https://ghostscript.readthedocs.io/en/latest/Use.html#ddelaybind
    * (10.03.0) The "makeimagedevice" non-standard operator has been
      removed. It allowed low level access to the graphics library
      in a way that was, essentially impossible to secure.
    * (10.03.0) The "putdeviceprops", "getdeviceprops",
      "finddevice", "copydevice", "findprotodevice" non-standard
      operators have all been removed. They provided functionality
      that is either accessible through standard operators,
      or should not be used by user PostScript.
    * (10.03.0) The process of "tidying" the PostScript namespace
      should have removed only non-standard and undocumented
      operators. Nevertheless, it is possible that any integrations
      or utilities that rely on those non-standard and undocumented
      operators may stop working or may change behaviour.
    If you encounter such a case, please contact us
    (Discord https://discord.gg/H9GXKwyPvY
    [#]ghostscript IRC channel https://web.libera.chat/#ghostscript
    or the gs-devel mailing list
    https://www.ghostscript.com/mailman/index.html would be best),
    but remember that free versions of Ghostscript
    come with with NO WARRANTY and NO SUPPORT.
  - Ghostscript 10.03.0 contains the fix to build with GCC 14
    (boo#1221687)
* Tue Feb 27 2024 Dominique Leuenberger <dimstar@opensuse.org>
  - Use %patch -P N instead of deprecated %patchN.
* Thu Feb 22 2024 Thorsten Kukuk <kukuk@suse.com>
  - Allow to disable apparmor support (ALP supports only SELinux)
* Sun Jan 28 2024 Dirk Müller <dmueller@suse.com>
  - update to 10.02.1:
    * Patch release to address some security bugs
    * This release (10.02.0) marks the final demise of the
      PostScript based PDF interpreter.
    * This 10.01.1 release removes the "-dNEWPDF=false" command
      line option to fall back to the deprecated, old PDF
      interpreter.
    * This 10.01.0 release removes the "-dNEWPDF=false" command
      line option to fall back to the deprecated, old PDF
      interpreter.
    * This release officially deprecates the old Postscript
      implementation of PDF, we will not be updating or maintaining
      that code moving forward. The option to use the old PDF
      implementation _**will**_ be removed in the next full release
      (10.01.0)
    * Important: This release includes the new PDF interpreter
      (implemented in C rather than PostScript). It is both
      integrated into Ghostscript (now ENABLED by default), and
      available as a standalone, PDF only, binary. See
      https://ghostscript.com/pdfi.html for more details.
    * This also bundles the latest zlib (1.2.12) which addresses a
      security issue (CVE-2018-25032)
    * **Important**: This release includes the new PDF interpreter
      (implemented in C rather than PostScript). It is both
      integrated into Ghostscript (now **ENABLED** by default), and
      available as a standalone, PDF only, binary. See
      https://ghostscript.com/pdfi.html for more details.
  - drop CVE-2023-28879.patch, CVE-2023-36664.patch,
      CVE-2023-38559.patch, CVE-2023-43115.patch,
      CVE-2023-46751.patch: upstream
  - drop remove-zlib-h-dependency.patch: unused
* Wed Jan 03 2024 Johannes Meixner <jsmeix@suse.com>
  - CVE-2023-46751.patch is
    https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13
    adapted for Ghostscript-9.56.1 that fixes
    https://bugs.ghostscript.com/show_bug.cgi?id=707264
    which includes a fix for CVE-2023-46751
    "dangling pointer in gdev_prn_open_printer_seekable()"
    (bsc#1217871)
* Mon Dec 18 2023 Dominique Leuenberger <dimstar@opensuse.org>
  - Recommend cups-filters only when cups is present.
* Wed Sep 20 2023 Johannes Meixner <jsmeix@suse.com>
  - CVE-2023-43115.patch is
    https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e59216049cac290fb437a04c4f41ea46826cfba5
    that fixes CVE-2023-43115 "remote code execution
    via crafted PostScript documents in gdevijs.c"
    see https://bugs.ghostscript.com/show_bug.cgi?id=707051
    (bsc#1215466)
* Wed Jul 26 2023 Johannes Meixner <jsmeix@suse.com>
  - CVE-2023-38559.patch fixes CVE-2023-38559
    "out of bounds read devn_pcx_write_rle() could result in DoS"
    see bsc#1213637
    and https://bugs.ghostscript.com/show_bug.cgi?id=706897
    which is in base/gdevdevn.c the same issue
    "ordering in if expression to avoid out-of-bounds access"
    as the already fixed CVE-2020-16305 in devices/gdevpcx.c
    see https://bugs.ghostscript.com/show_bug.cgi?id=701819
* Tue Jul 04 2023 Johannes Meixner <jsmeix@suse.com>
  - CVE-2023-36664.patch fixes CVE-2023-36664
    see https://bugs.ghostscript.com/show_bug.cgi?id=706761
    "OS command injection in %pipe% access"
    and https://bugs.ghostscript.com/show_bug.cgi?id=706778
    "%pipe% allowed_path bypass"
    and bsc#1212711
    "permission validation mishandling for pipe devices
    (with the %pipe% prefix or the | pipe character prefix)"
* Wed Apr 26 2023 Jan Engelhardt <jengelh@inai.de>
  - Replace BuildRequire on xorg-x11-devel by pkgconfig(...)
* Tue Apr 11 2023 Johannes Meixner <jsmeix@suse.com>
  - CVE-2023-28879.patch fixes CVE-2023-28879
    Buffer Overflow in s_xBCPE_process
    cf. https://bugs.ghostscript.com/show_bug.cgi?id=706494
    (bsc#1210062)
* Mon Jul 18 2022 Dirk Müller <dmueller@suse.com>
  - update to 9.56.1:
    Highlights in this release include
    (excerpts from the Ghostscript upstream release summary
    in https://ghostscript.com/docs/9.56.1/News.htm):
    * New PDF Interpreter: This is an entirely new implementation
      written in C (rather than PostScript, as before)
    * Calling Ghostscript via the GS API is now thread safe. The one
      limitation is that the X11 devices for Unix-like systems (x11,
      x11alpha, x11cmyk, x11cmyk2, x11cmyk4, x11cmyk8, x11gray2,
      x11gray4 and x11mono) cannot be made thread safe, due to their
      interaction with the X11 server, those devices have been
      modified to only allow one instance in an executable.
    * The PSD output device now writes ICC profiles to their output
      files, for improved color fidelity.
    * Our efforts in code hygiene and maintainability continue.
    * The usual round of bug fixes, compatibility changes, and
      incremental improvements.
    * We have added the capability to build with the Tesseract OCR
      engine. In such a build, new devices are available
      (pdfocr8/pdfocr24/pdfocr32) which render the output file to an
      image, OCR that image, and output the image "wrapped" up as a
      PDF file, with the OCR generated text information included
      as "invisible" text (in PDF terms, text rendering mode 3).
      Mainly due to time constraints, we only support including
      Tesseract from source included in our release packages,
      and not linking to Tesseract/Leptonica shared libraries.
      Whether we add this capability will be largely dependent
      on community demand for the feature. See Enabling OCR
      at https://www.ghostscript.com/ocr.html for more details.
    For a release summary see:
    https://www.ghostscript.com/doc/9.54.0/News.htm
    For details see the News.htm and History9.htm files.
  - Configure --without-tesseract because this requires C++ (it
    might be added if Tesseract support in Ghostscript is needed).
  - Drop CVE-2021-3781.patch, CVE-2021-45949.patch: upstream
* Mon Jul 18 2022 Dirk Müller <dmueller@suse.com>
  - Use _multibuild
* Wed Apr 13 2022 Dirk Müller <dmueller@suse.com>
  - Use system zlib (bsc#1198449)
* Thu Apr 07 2022 Frederic Crozat <fcrozat@suse.com>
  - Do no longer require apparmor-abstractions, it is not mandatory
    to use Ghostscript (bsc#1134289).
* Tue Jan 11 2022 jsmeix@suse.de
  - CVE-2021-45949.patch fixes CVE-2021-45949
    heap-based buffer overflow in sampled_data_finish
    cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml
    (bsc#1194304)
  - CVE-2021-45944 use-after-free in sampled_data_sample
    is already fixed in the Ghostscript 9.54.0 upstream sources
    (bsc#1194303)
* Fri Sep 10 2021 jsmeix@suse.de
  - CVE-2021-3781.patch fixes CVE-2021-3781
    Trivial -dSAFER bypass
    cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
    (bsc#1190381)
* Fri May 21 2021 jsmeix@suse.de
  - Version upgrade to 9.54.0
    Highlights in this release include
    (excerpts from the Ghostscript upstream release summary
    in https://www.ghostscript.com/doc/9.54.0/News.htm):
    * The 9.54.0 release is a maintenance release,
      and also adds new functionality.
    * Overprint simulation is now available to all output devices,
      allowing quality previewing/proofing of PostScript and
      PDF jobs that rely on overprint. See the -dOverprint option
      documentation in: doc/9.54.0/Use.htm#Overprint
    * The "docxwrite" device adds the ability to output
      to Microsoft Word "docx" format.
      See: doc/9.54.0/VectorDevices.htm#DOCX
    * The pdfwrite device is now capable of using the Tesseract OCR
      engine when it is built into Ghostscript to improve
      searchability and copy and paste functionality when the input
      lacks the metadata for that purpose.
      See: doc/9.54.0/VectorDevices.htm#UseOCR
    * Ghostscript/GhostPDL now includes a "map text to black"
      function, where text drawn by an input job (except when drawn
      using a Type 3 font) can be forced to draw in solid black.
      See: doc/9.54.0/Use.htm#BlackText
    * Ghostscript/GhostPDL now supports simple N-up imposition
      "internally". See: doc/9.54.0/Use.htm#NupControl
    * Our efforts in code hygiene and maintainability continue.
    * The usual round of bug fixes, compatibility changes,
      and incremental improvements.
    * For a list of open issues, or to report problems, please visit
      bugs.ghostscript.com
    For a release summary see:
    https://www.ghostscript.com/doc/9.54.0/News.htm
    For details see the News.htm and History9.htm files.
  - 41ef9a0bc36b9db7115fbe9623f989bfb47bbade.patch is no longer
    needed because it is fixed in the upstream sources.
* Wed Apr 14 2021 Wolfgang Frisch <wolfgang.frisch@suse.com>
  - Hardening: compile with PIC, link as PIE

Files

/usr/include/ghostscript
/usr/include/ghostscript/gdevdsp.h
/usr/include/ghostscript/gserrors.h
/usr/include/ghostscript/iapi.h
/usr/include/ghostscript/ierrors.h
/usr/include/ijs
/usr/include/ijs/ijs.h
/usr/include/ijs/ijs_client.h
/usr/include/ijs/ijs_server.h
/usr/lib64/libgs.so
/usr/lib64/libijs.so
/usr/lib64/pkgconfig/ijs.pc


Generated by rpm2html 1.8.1

Fabrice Bellet, Wed Oct 23 00:40:55 2024