From 2607e26d9e9681420008a6006d9f4f8245ebfa34 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Fri, 4 Sep 2026 01:44:28 +0800 Subject: [PATCH 1/2] fix(cve): CVE-2025-59799 - [PATCH] pdfwrite - bounds check some strings CVE: CVE-2025-59799 (medium) - Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. Upstream: https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781 Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 9 +++++++++ debian/patches/CVE-2025-59799.patch | 28 ++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 38 insertions(+) create mode 100644 debian/patches/CVE-2025-59799.patch diff --git a/debian/changelog b/debian/changelog index 9cfbbf7..d3a4803 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium + + * fix(cve): CVE-2025-59799 (medium) - [PATCH] pdfwrite - bounds check + some strings Upstream: + https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226 + c242ab7a83fa53e4b0ff781 + + -- deepin-ci-robot Fri, 04 Sep 2026 01:44:28 +0800 + ghostscript (10.05.1~dfsg-3deepin3) unstable; urgency=medium * fix(cve): CVE-2025-59798 diff --git a/debian/patches/CVE-2025-59799.patch b/debian/patches/CVE-2025-59799.patch new file mode 100644 index 0000000..2ae82a7 --- /dev/null +++ b/debian/patches/CVE-2025-59799.patch @@ -0,0 +1,28 @@ +Description: CVE-2025-59799 (medium) - Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value. +Author: Piotr Kajda +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226c242ab7a83fa53e4b0ff781 +Bug: https://security-tracker.debian.org/tracker/CVE-2025-59799 +Last-Update: 2025-05-08 +--- +diff --git a/devices/vector/gdevpdfm.c b/devices/vector/gdevpdfm.c +index d1237c9..c120ba1 100644 +--- a/devices/vector/gdevpdfm.c ++++ b/devices/vector/gdevpdfm.c +@@ -199,6 +199,8 @@ pdfmark_coerce_dest(gs_param_string *dstr, char dest[MAX_DEST_STRING]) + { + const byte *data = dstr->data; + uint size = dstr->size; ++ if (size > MAX_DEST_STRING) ++ return_error(gs_error_limitcheck); + if (size == 0 || data[0] != '(') + return 0; + /****** HANDLE ESCAPES ******/ +@@ -859,6 +861,8 @@ pdfmark_put_ao_pairs(gx_device_pdf * pdev, cos_dict_t *pcd, + char buf[30]; + int d0, d1; + ++ if (Action[1].size > 29) ++ return_error(gs_error_rangecheck); + memcpy(buf, Action[1].data, Action[1].size); + buf[Action[1].size] = 0; + if (sscanf(buf, "%d %d R", &d0, &d1) == 2) diff --git a/debian/patches/series b/debian/patches/series index 8b22111..996a47b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -17,3 +17,4 @@ CVE-2025-59798.patch CVE-2025-59801.patch CVE-2025-59800.patch +CVE-2025-59799.patch From 493b5dd345841fe5ac833f067770ca1f8207db95 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Tue, 22 Sep 2026 20:09:30 +0800 Subject: [PATCH 2/2] fix(cve): CVE-2026-39919 - OpenJPEG - Fix overreading bytes in some conditions. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE: CVE-2026-39919 (critical) - 堆缓冲区溢出在 JPEG 2000 (JPXDecode) 输出适配器中，通过组件重采样不匹配导致 Upstream: https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1 Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 4 +++ debian/patches/CVE-2026-39919.patch | 41 +++++++++++++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 46 insertions(+) create mode 100644 debian/patches/CVE-2026-39919.patch diff --git a/debian/changelog b/debian/changelog index d3a4803..48da389 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,6 +4,10 @@ ghostscript (10.05.1~dfsg-3deepin4) unstable; urgency=medium some strings Upstream: https://github.com/ArtifexSoftware/ghostpdl/commit/6dab38fb211f15226 c242ab7a83fa53e4b0ff781 + * fix(cve): CVE-2026-39919 (critical) - OpenJPEG - Fix overreading + bytes in some conditions. Upstream: + https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b07 + 51a58d6ec1cf992073e4dc1 -- deepin-ci-robot Fri, 04 Sep 2026 01:44:28 +0800 diff --git a/debian/patches/CVE-2026-39919.patch b/debian/patches/CVE-2026-39919.patch new file mode 100644 index 0000000..f09b9ac --- /dev/null +++ b/debian/patches/CVE-2026-39919.patch @@ -0,0 +1,41 @@ +Description: CVE-2026-39919 (critical) - 堆缓冲区溢出在 JPEG 2000 (JPXDecode) 输出适配器中，通过组件重采样不匹配导致 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/0a8bf88e39db07b0751a58d6ec1cf992073e4dc1 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-39919 +Last-Update: 2026-08-24 +--- +diff --git a/base/sjpx_openjpeg.c b/base/sjpx_openjpeg.c +index a4e3644..16e5e6c 100644 +--- a/base/sjpx_openjpeg.c ++++ b/base/sjpx_openjpeg.c +@@ -490,6 +490,9 @@ static int decode_image(stream_jpxd_state * const state) + if (state->bpp == 12) + state->bpp = 16; + ++ if (state->bpp != 1 && state->bpp != 2 && state->bpp != 4 && state->bpp != 8 && state->bpp != 16) ++ return ERRC; ++ + /* calculate total data */ + rowbytes = (state->width*state->bpp*state->out_numcomps+7)/8; + state->totalbytes = (ulong)rowbytes*state->height; +@@ -654,16 +657,17 @@ static int process_one_trunk(stream_jpxd_state * const state, stream_cursor_writ + int ppbyte1 = 8/state->bpp; + /* sampling required */ + /* only grayscale can have such bit-depth, also shift_bit = 0, bpp < 8 */ +- for (i = 0; i < state->width; i++) ++ for (i = 0; i < state->width; ) + { +- for (b=0; bimage->comps[compno].dx; + int dy = state->image->comps[compno].dy; + int w = state->image->comps[compno].w; + int in_offset_scaled = (y_offset/dy * w) + i / dx; + bt = bt<bpp; +- bt += state->image->comps[compno].data[in_offset_scaled] + state->sign_comps[compno]; ++ if (i < state->width) ++ bt += state->image->comps[compno].data[in_offset_scaled] + state->sign_comps[compno]; + } + *row++ = bt; + } diff --git a/debian/patches/series b/debian/patches/series index 996a47b..1cb438f 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -18,3 +18,4 @@ CVE-2025-59798.patch CVE-2025-59801.patch CVE-2025-59800.patch CVE-2025-59799.patch +CVE-2026-39919.patch