diff options
Diffstat (limited to 'app-text/a2ps/files/a2ps-4.14-CVE-2014-0466.patch')
-rw-r--r-- | app-text/a2ps/files/a2ps-4.14-CVE-2014-0466.patch | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/app-text/a2ps/files/a2ps-4.14-CVE-2014-0466.patch b/app-text/a2ps/files/a2ps-4.14-CVE-2014-0466.patch new file mode 100644 index 000000000000..56f0b2f527a2 --- /dev/null +++ b/app-text/a2ps/files/a2ps-4.14-CVE-2014-0466.patch @@ -0,0 +1,32 @@ +CVE-2014-0466: fixps does not invoke gs with -dSAFER + +A malicious PostScript file could delete files with the privileges of +the invoking user. + +Author: Salvatore Bonaccorso <carnil@debian.org> +Origin: https://bugs.debian.org/742902 + +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/contrib/fixps.in a2ps/contrib/fixps.in +--- a2ps~/contrib/fixps.in 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/contrib/fixps.in 2014-03-30 12:40:36.763249218 +0200 +@@ -389,7 +389,7 @@ + eval "$command" ;; + gs) + $verbose "$program: making a full rewrite of the file ($gs)." >&2 +- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; ++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; + esac + ) + fi +diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' a2ps~/contrib/fixps.m4 a2ps/contrib/fixps.m4 +--- a2ps~/contrib/fixps.m4 2014-03-30 12:24:50.000000000 +0200 ++++ a2ps/contrib/fixps.m4 2014-03-30 12:40:36.767249254 +0200 +@@ -307,7 +307,7 @@ + eval "$command" ;; + gs) + $verbose "$program: making a full rewrite of the file ($gs)." >&2 +- $gs -q -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; ++ $gs -q -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pswrite -sOutputFile=- -c save pop -f $file ;; + esac + ) + fi |