Changelog for ghostscript-mini-10.02.1-4.1.x86_64.rpm :

* Tue Feb 27 2024 Dominique Leuenberger - Use %patch -P N instead of deprecated %patchN.
* Thu Feb 22 2024 Thorsten Kukuk - Allow to disable apparmor support (ALP supports only SELinux)
* Sun Jan 28 2024 Dirk Müller - update to 10.02.1:
* Patch release to address some security bugs
* This release (10.02.0) marks the final demise of the PostScript based PDF interpreter.
* This 10.01.1 release removes the \"-dNEWPDF=false\" command line option to fall back to the deprecated, old PDF interpreter.
* This 10.01.0 release removes the \"-dNEWPDF=false\" command line option to fall back to the deprecated, old PDF interpreter.
* This release officially deprecates the old Postscript implementation of PDF, we will not be updating or maintaining that code moving forward. The option to use the old PDF implementation _
*
*will
*
*_ be removed in the next full release (10.01.0)
* Important: This release includes the new PDF interpreter (implemented in C rather than PostScript). It is both integrated into Ghostscript (now ENABLED by default), and available as a standalone, PDF only, binary. See https://ghostscript.com/pdfi.html for more details.
* This also bundles the latest zlib (1.2.12) which addresses a security issue (CVE-2018-25032)
*
*
*Important
*
*: This release includes the new PDF interpreter (implemented in C rather than PostScript). It is both integrated into Ghostscript (now
*
*ENABLED
*
* by default), and available as a standalone, PDF only, binary. See https://ghostscript.com/pdfi.html for more details.- drop CVE-2023-28879.patch, CVE-2023-36664.patch, CVE-2023-38559.patch, CVE-2023-43115.patch, CVE-2023-46751.patch: upstream- drop remove-zlib-h-dependency.patch: unused
* Wed Jan 03 2024 Johannes Meixner - CVE-2023-46751.patch is https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=dcdbc595c13 adapted for Ghostscript-9.56.1 that fixes https://bugs.ghostscript.com/show_bug.cgi?id=707264 which includes a fix for CVE-2023-46751 \"dangling pointer in gdev_prn_open_printer_seekable()\" (bsc#1217871)
* Mon Dec 18 2023 Dominique Leuenberger - Recommend cups-filters only when cups is present.
* Wed Sep 20 2023 Johannes Meixner - CVE-2023-43115.patch is https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=e59216049cac290fb437a04c4f41ea46826cfba5 that fixes CVE-2023-43115 \"remote code execution via crafted PostScript documents in gdevijs.c\" see https://bugs.ghostscript.com/show_bug.cgi?id=707051 (bsc#1215466)
* Wed Jul 26 2023 Johannes Meixner - CVE-2023-38559.patch fixes CVE-2023-38559 \"out of bounds read devn_pcx_write_rle() could result in DoS\" see bsc#1213637 and https://bugs.ghostscript.com/show_bug.cgi?id=706897 which is in base/gdevdevn.c the same issue \"ordering in if expression to avoid out-of-bounds access\" as the already fixed CVE-2020-16305 in devices/gdevpcx.c see https://bugs.ghostscript.com/show_bug.cgi?id=701819
* Tue Jul 04 2023 Johannes Meixner - CVE-2023-36664.patch fixes CVE-2023-36664 see https://bugs.ghostscript.com/show_bug.cgi?id=706761 \"OS command injection in %pipe% access\" and https://bugs.ghostscript.com/show_bug.cgi?id=706778 \"%pipe% allowed_path bypass\" and bsc#1212711 \"permission validation mishandling for pipe devices (with the %pipe% prefix or the | pipe character prefix)\"
* Wed Apr 26 2023 Jan Engelhardt - Replace BuildRequire on xorg-x11-devel by pkgconfig(...)
* Tue Apr 11 2023 Johannes Meixner - CVE-2023-28879.patch fixes CVE-2023-28879 Buffer Overflow in s_xBCPE_process cf. https://bugs.ghostscript.com/show_bug.cgi?id=706494 (bsc#1210062)
* Mon Jul 18 2022 Dirk Müller - update to 9.56.1: Highlights in this release include (excerpts from the Ghostscript upstream release summary in https://ghostscript.com/docs/9.56.1/News.htm):
* New PDF Interpreter: This is an entirely new implementation written in C (rather than PostScript, as before)
* Calling Ghostscript via the GS API is now thread safe. The one limitation is that the X11 devices for Unix-like systems (x11, x11alpha, x11cmyk, x11cmyk2, x11cmyk4, x11cmyk8, x11gray2, x11gray4 and x11mono) cannot be made thread safe, due to their interaction with the X11 server, those devices have been modified to only allow one instance in an executable.
* The PSD output device now writes ICC profiles to their output files, for improved color fidelity.
* Our efforts in code hygiene and maintainability continue.
* The usual round of bug fixes, compatibility changes, and incremental improvements.
* We have added the capability to build with the Tesseract OCR engine. In such a build, new devices are available (pdfocr8/pdfocr24/pdfocr32) which render the output file to an image, OCR that image, and output the image \"wrapped\" up as a PDF file, with the OCR generated text information included as \"invisible\" text (in PDF terms, text rendering mode 3). Mainly due to time constraints, we only support including Tesseract from source included in our release packages, and not linking to Tesseract/Leptonica shared libraries. Whether we add this capability will be largely dependent on community demand for the feature. See Enabling OCR at https://www.ghostscript.com/ocr.html for more details. For a release summary see: https://www.ghostscript.com/doc/9.54.0/News.htm For details see the News.htm and History9.htm files.- Configure --without-tesseract because this requires C++ (it might be added if Tesseract support in Ghostscript is needed).- Drop CVE-2021-3781.patch, CVE-2021-45949.patch: upstream
* Mon Jul 18 2022 Dirk Müller - Use _multibuild
* Wed Apr 13 2022 Dirk Müller - Use system zlib (bsc#1198449)
* Thu Apr 07 2022 Frederic Crozat - Do no longer require apparmor-abstractions, it is not mandatory to use Ghostscript (bsc#1134289).
* Tue Jan 11 2022 jsmeixAATTsuse.de- CVE-2021-45949.patch fixes CVE-2021-45949 heap-based buffer overflow in sampled_data_finish cf. https://github.com/google/oss-fuzz-vulns/blob/main/vulns/ghostscript/OSV-2021-803.yaml (bsc#1194304)- CVE-2021-45944 use-after-free in sampled_data_sample is already fixed in the Ghostscript 9.54.0 upstream sources (bsc#1194303)
* Fri Sep 10 2021 jsmeixAATTsuse.de- CVE-2021-3781.patch fixes CVE-2021-3781 Trivial -dSAFER bypass cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342 (bsc#1190381)
* Fri May 21 2021 jsmeixAATTsuse.de- Version upgrade to 9.54.0 Highlights in this release include (excerpts from the Ghostscript upstream release summary in https://www.ghostscript.com/doc/9.54.0/News.htm):
* The 9.54.0 release is a maintenance release, and also adds new functionality.
* Overprint simulation is now available to all output devices, allowing quality previewing/proofing of PostScript and PDF jobs that rely on overprint. See the -dOverprint option documentation in: doc/9.54.0/Use.htm#Overprint
* The \"docxwrite\" device adds the ability to output to Microsoft Word \"docx\" format. See: doc/9.54.0/VectorDevices.htm#DOCX
* The pdfwrite device is now capable of using the Tesseract OCR engine when it is built into Ghostscript to improve searchability and copy and paste functionality when the input lacks the metadata for that purpose. See: doc/9.54.0/VectorDevices.htm#UseOCR
* Ghostscript/GhostPDL now includes a \"map text to black\" function, where text drawn by an input job (except when drawn using a Type 3 font) can be forced to draw in solid black. See: doc/9.54.0/Use.htm#BlackText
* Ghostscript/GhostPDL now supports simple N-up imposition \"internally\". See: doc/9.54.0/Use.htm#NupControl
* Our efforts in code hygiene and maintainability continue.
* The usual round of bug fixes, compatibility changes, and incremental improvements.
* For a list of open issues, or to report problems, please visit bugs.ghostscript.com For a release summary see: https://www.ghostscript.com/doc/9.54.0/News.htm For details see the News.htm and History9.htm files.- 41ef9a0bc36b9db7115fbe9623f989bfb47bbade.patch is no longer needed because it is fixed in the upstream sources.
* Wed Apr 14 2021 Wolfgang Frisch - Hardening: compile with PIC, link as PIE