From 24323c64564d5a774f84e54a13fc28b0f29a5ee1 Mon Sep 17 00:00:00 2001 From: hudeng Date: Tue, 18 Aug 2026 13:56:17 +0800 Subject: [PATCH 1/2] fix(cve): CVE-2025-59801 and CVE-2025-59800 CVE-2025-59801: XPS interpreter - check some TIFF values to prevent stack-buffer-overwrite when parsing a malicious TIFF file in XPS file. Upstream: https://github.com/ArtifexSoftware/ghostpdl/commit/99727069197d548a8db69ba5d63f766bff40eaab CVE-2025-59800: PDF OCR 8 bit device - avoid overflow. Make sure the calculation of the required raster size does not overflow an int. Upstream: https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350 Co-authored-by: hudeng --- debian/changelog | 7 +++++++ debian/patches/CVE-2025-59800.patch | 25 +++++++++++++++++++++++++ debian/patches/CVE-2025-59801.patch | 26 ++++++++++++++++++++++++++ debian/patches/series | 2 ++ 4 files changed, 60 insertions(+) create mode 100644 debian/patches/CVE-2025-59800.patch create mode 100644 debian/patches/CVE-2025-59801.patch diff --git a/debian/changelog b/debian/changelog index d611187..d2fc644 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +ghostscript (10.05.1~dfsg-3deepin2) unstable; urgency=medium + + * fix(cve): CVE-2025-59801 - XPS 解释器在解析恶意 TIFF 文件时存在栈缓冲区溢出漏洞 + * fix(cve): CVE-2025-59800 - PDF OCR 8 bit device - avoid overflow. 整数溢出漏洞，可能导致堆溢出 + + -- hudeng Mon, 18 Aug 2025 13:55:00 +0800 + ghostscript (10.05.1~dfsg-3deepin1) unstable; urgency=medium * Add libgs9-common transitional package for smooth upgrading diff --git a/debian/patches/CVE-2025-59800.patch b/debian/patches/CVE-2025-59800.patch new file mode 100644 index 0000000..695d115 --- /dev/null +++ b/debian/patches/CVE-2025-59800.patch @@ -0,0 +1,25 @@ +Description: CVE-2025-59800 - 安全修复 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/176cf0188a2294bc307b8caec876f39412e58350 +Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59800 +Last-Update: 2025-07-01 +--- +diff --git a/devices/gdevpdfocr.c b/devices/gdevpdfocr.c +index 1c1e8eab8..7c9c12f8c 100644 +--- a/devices/gdevpdfocr.c ++++ b/devices/gdevpdfocr.c +@@ -521,9 +521,12 @@ ocr_line32(gx_device_pdf_image *dev, void *row) + static int + ocr_begin_page(gx_device_pdf_image *dev, int w, int h, int bpp) + { +- int raster = (w+3)&~3; ++ int64_t raster = (w + 3) & ~3; + +- dev->ocr.data = gs_alloc_bytes(dev->memory, raster * h, "ocr_begin_page"); ++ raster = raster * (int64_t)h; ++ if (raster < 0 || raster > max_size_t) ++ return gs_note_error(gs_error_VMerror); ++ dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page"); + if (dev->ocr.data == NULL) + return_error(gs_error_VMerror); + dev->ocr.w = w; \ No newline at end of file diff --git a/debian/patches/CVE-2025-59801.patch b/debian/patches/CVE-2025-59801.patch new file mode 100644 index 0000000..9120fe3 --- /dev/null +++ b/debian/patches/CVE-2025-59801.patch @@ -0,0 +1,26 @@ +Description: CVE-2025-59801 - 安全修复 +Author: Ken Sharp +Origin: https://github.com/ArtifexSoftware/ghostpdl/commit/99727069197d548a8db69ba5d63f766bff40eaab +Bug: https://nvd.nist.gov/vuln/detail/CVE-2025-59801 +Last-Update: 2025-09-09 +--- +diff --git a/xps/xpstiff.c b/xps/xpstiff.c +index 484ed5b3a..83cb913d1 100644 +--- a/xps/xpstiff.c ++++ b/xps/xpstiff.c +@@ -1175,6 +1175,15 @@ xps_decode_tiff(xps_context_t *ctx, byte *buf, int len, xps_image_t *image) + if (tiff->rowsperstrip > tiff->imagelength) + tiff->rowsperstrip = tiff->imagelength; + ++ if (tiff->bitspersample != 1 && tiff->bitspersample != 4 && tiff->bitspersample != 8 && tiff->bitspersample != 16) ++ return gs_rethrow(error, "Illegal BitsPerSample in TIFF header"); ++ ++ if (tiff->samplesperpixel != 1 && tiff->samplesperpixel != 3 && tiff->samplesperpixel != 4 && tiff->samplesperpixel != 5) ++ return gs_rethrow(error, "Illegal SamplesPerPixel in TIFF header"); ++ ++ if (tiff->compression < 1 || (tiff->compression > 5 && (tiff->compression != 7 && tiff->compression != 32773))) ++ return gs_rethrow(error, "Illegal Compression in TIFF header"); ++ + error = xps_decode_tiff_strips(ctx, tiff, image); + if (error) + return gs_rethrow(error, "could not decode image data"); \ No newline at end of file diff --git a/debian/patches/series b/debian/patches/series index 2d3f9ca..f71a525 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -14,3 +14,5 @@ 2010_add_build_timestamp_setting.patch 2011_disable_google_analytics.patch 2012_additional_gcc_15_fixes.patch +CVE-2025-59801.patch +CVE-2025-59800.patch From 01243240b62a7a56794f3b652a2a0207d55e5048 Mon Sep 17 00:00:00 2001 From: hudeng Date: Tue, 18 Aug 2026 13:59:24 +0800 Subject: [PATCH 2/2] fix: add trailing newlines to patch files to fix dpkg-source malformed patch error --- debian/patches/CVE-2025-59800.patch | 2 +- debian/patches/CVE-2025-59801.patch | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/debian/patches/CVE-2025-59800.patch b/debian/patches/CVE-2025-59800.patch index 695d115..202f281 100644 --- a/debian/patches/CVE-2025-59800.patch +++ b/debian/patches/CVE-2025-59800.patch @@ -22,4 +22,4 @@ index 1c1e8eab8..7c9c12f8c 100644 + dev->ocr.data = gs_alloc_bytes(dev->memory, raster, "ocr_begin_page"); if (dev->ocr.data == NULL) return_error(gs_error_VMerror); - dev->ocr.w = w; \ No newline at end of file + dev->ocr.w = w; diff --git a/debian/patches/CVE-2025-59801.patch b/debian/patches/CVE-2025-59801.patch index 9120fe3..bd49abb 100644 --- a/debian/patches/CVE-2025-59801.patch +++ b/debian/patches/CVE-2025-59801.patch @@ -23,4 +23,4 @@ index 484ed5b3a..83cb913d1 100644 + error = xps_decode_tiff_strips(ctx, tiff, image); if (error) - return gs_rethrow(error, "could not decode image data"); \ No newline at end of file + return gs_rethrow(error, "could not decode image data");