package/ghostscript: security bump to v10.06.0

For release note, see:
https://ghostscript.readthedocs.io/en/gs10.06.0/News.html

This fixes the following vulnerabilities:
- CVE-2025-59798:
    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow
    in pdf_write_cmap in devices/vector/gdevpdtw.c.
    https://www.cve.org/CVERecord?id=CVE-2025-59798

- CVE-2025-59799:
    Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow
    in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size
    value.
    https://www.cve.org/CVERecord?id=CVE-2025-59799

- CVE-2025-59800:
    In Artifex Ghostscript through 10.05.1, ocr_begin_page in
    devices/gdevpdfocr.c has an integer overflow that leads to a heap-
    based buffer overflow in ocr_line8.
    https://www.cve.org/CVERecord?id=CVE-2025-59800

- CVE-2025-59801:
    In Artifex GhostXPS before 10.06.0, there is a stack-based buffer
    overflow in xps_unpredict_tiff in xpstiff.c because the
    samplesperpixel value is not checked.
    https://www.cve.org/CVERecord?id=CVE-2025-59801

Also remove patch that is now applied upstream, and add new patch from
upstream to fix a compilation issue on 32bits platforms

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien:
 - add link to release note in commit log
 - fix URL in hash file comment
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Titouan Christophe
2025-10-03 19:12:45 +02:00
committed by Julien Olivain
parent d1bd6aab49
commit 6f984089c0
4 changed files with 66 additions and 39 deletions
+1 -1
View File
@@ -4,7 +4,7 @@
#
################################################################################
GHOSTSCRIPT_VERSION = 10.05.1
GHOSTSCRIPT_VERSION = 10.06.0
GHOSTSCRIPT_SOURCE = ghostscript-$(GHOSTSCRIPT_VERSION).tar.xz
GHOSTSCRIPT_SITE = https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs$(subst .,,$(GHOSTSCRIPT_VERSION))
GHOSTSCRIPT_LICENSE = AGPL-3.0